Function at 0x419a40
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5898ac
mov eax, dword fs:[0]
push eax
sub esp, 0xbac
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 0xba4], eax
push esi
push edi
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0xbb8]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
cmp byte [esi + 0x10], 0
je 0x419a90
call fcn.00426820
xor eax, eax
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
mov dword [esp + 0x74], 7
mov dword [esp + 0x70], 0
mov word [esp + 0x60], ax
mov dword [esp + 0xbc0], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], eax
mov dword [esp + 0x8c], 7
mov dword [esp + 0x88], eax
mov word [esp + 0x78], ax
mov byte [esp + 0xbc0], 1
xorps xmm0, xmm0
xor ecx, ecx
movq qword [esp + 0x4c], xmm0
mov dword [esp + 0x4c], ecx
xor edi, edi
mov dword [esp + 0x54], eax
mov dword [esp + 0x50], edi
mov dword [esp + 0x54], ecx
mov byte [esp + 0xbc0], 2
movq qword [esp + 0x90], xmm0
mov dword [esp + 0x98], edi
mov dword [esp + 0x90], edi
mov dword [esp + 0x94], edi
mov dword [esp + 0x98], edi
mov byte [esp + 0xbc0], 3
xor dl, dl
mov eax, dword [esi + 4]
mov byte [esp + 0xf], dl
mov dword [esp + 0x48], eax
cmp eax, dword [esi + 8]
je 0x419e48
mov al, byte [esi + 0x7b]
test al, al
jne 0x419e2a
mov esi, dword [esp + 0x48]
cmp dword [esi + 0x30], 8
lea edi, [esi + 0x1c]
jb 0x419b6f
mov ecx, dword [edi]
jmp 0x419b71
mov ecx, edi
mov edx, str.2345pcsafe
call fcn.004afc30
test al, al
jne 0x419baf
cmp dword [edi + 0x14], 8
jb 0x419b89
mov ecx, dword [edi]
jmp 0x419b8b
mov ecx, edi
mov edx, str.pcsafeoffice
call fcn.004afc30
test al, al
jne 0x419baf
cmp dword [edi + 0x14], 8
jb 0x419ba3
mov ecx, dword [edi]
jmp 0x419ba5
mov ecx, edi
mov edx, str.guanjia
call fcn.004afc30
mov ecx, esi
call fcn.0042c180
test al, al
je 0x419bc7
cmp byte [esi + 0xbc], 0
je 0x419e0b
push 0x110
lea eax, [esp + 0xec]
mov dword [esp + 0xe8], 0x114
push 0
push eax
call fcn.0056cbb0
add esp, 0xc
lea eax, [esp + 0xe4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x419c1b
mov eax, dword [esp + 0xe8]
cmp eax, 6
ja 0x419dcf
jne 0x419c1b
cmp dword [esp + 0xec], 1
jae 0x419dcf
cmp dword [edi + 0x14], 8
jb 0x419c25
mov ecx, dword [edi]
jmp 0x419c27
mov ecx, edi
mov edx, str.mgtv
call fcn.004afc30
test al, al
jne 0x419e0b
cmp dword [edi + 0x14], 8
jb 0x419c43
mov ecx, dword [edi]
jmp 0x419c45
mov ecx, edi
mov edx, str.qq2013
call fcn.004afc30
test al, al
jne 0x419e0b
cmp dword [edi + 0x14], 8
jb 0x419c61
mov ecx, dword [edi]
jmp 0x419c63
mov ecx, edi
mov edx, str.xunlei
call fcn.004afc30
test al, al
jne 0x419e0b
cmp dword [edi + 0x14], 8
jb 0x419c7f
mov ecx, dword [edi]
jmp 0x419c81
mov ecx, edi
mov edx, 0x5a95cc
call fcn.004afc30
test al, al
jne 0x419e0b
cmp dword [edi + 0x14], 8
jb 0x419c9d
mov ecx, dword [edi]
jmp 0x419c9f
mov ecx, edi
mov edx, 0x5a95d8
call fcn.004afc30
test al, al
jne 0x419e0b
cmp dword [edi + 0x14], 8
jb 0x419cbb
mov ecx, dword [edi]
jmp 0x419cbd
mov ecx, edi
mov edx, str.weixin
call fcn.004afc30
test al, al
jne 0x419e0b
cmp dword [edi + 0x14], 8
jb 0x419cd9
mov ecx, dword [edi]
jmp 0x419cdb
mov ecx, edi
mov edx, str.evernote
call fcn.004afc30
test al, al
jne 0x419e0b
cmp dword [edi + 0x14], 8
jb 0x419cf7
mov ecx, dword [edi]
jmp 0x419cf9
mov ecx, edi
mov edx, 0x5a960c
call fcn.004afc30
test al, al
jne 0x419e0b
cmp dword [edi + 0x14], 8
jb 0x419d15
mov ecx, dword [edi]
jmp 0x419d17
mov ecx, edi
mov edx, str.2345pic
call fcn.004afc30
test al, al
jne 0x419e0b
cmp dword [edi + 0x14], 8
jb 0x419d33
mov ecx, dword [edi]
jmp 0x419d35
mov ecx, edi
mov edx, str.2345haozip
call fcn.004afc30
test al, al
jne 0x419e0b
cmp dword [edi + 0x14], 8
jb 0x419d51
mov ecx, dword [edi]
jmp 0x419d53
mov ecx, edi
mov edx, str.2345picoffice
call fcn.004afc30
test al, al
jne 0x419e0b
cmp dword [edi + 0x14], 8
jb 0x419d6f
mov ecx, dword [edi]
jmp 0x419d71
mov ecx, edi
mov edx, str.2345haozipoffice
call fcn.004afc30
test al, al
jne 0x419e0b
cmp dword [edi + 0x14], 8
jb 0x419d8d
mov ecx, dword [edi]
jmp 0x419d8f
mov ecx, edi
mov edx, 0x5a9620
call fcn.004afc30
test al, al
jne 0x419e0b
cmp dword [edi + 0x14], 8
jb 0x419da7
mov ecx, dword [edi]
jmp 0x419da9
mov ecx, edi
mov edx, str.zhineng
call fcn.004afc30
test al, al
jne 0x419e0b
cmp dword [edi + 0x14], 8
jb 0x419dbf
mov edi, dword [edi]
mov edx, str.zhinengoffice
mov ecx, edi
call fcn.004afc30
test al, al
jne 0x419e0b
mov edi, dword [esp + 0x10]
mov ecx, edi
push 0
push esi
call fcn.00424f40
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x68]
mov byte [esp + 0x1f], al
push ecx
lea ecx, [esp + 0x6c]
call fcn.004047c0
cmp byte [esp + 0x17], 0
je 0x419e0f
push esi
lea ecx, [esp + 0x50]
call fcn.0040bf30
mov dl, 1
mov byte [esp + 0xf], dl
jmp 0x419e13
mov edi, dword [esp + 0x10]
mov dl, byte [esp + 0xf]
add esi, 0xc0
cmp esi, dword [edi + 8]
mov dword [esp + 0x48], esi
mov esi, dword [esp + 0x10]
jne 0x419b53
test dl, dl
je 0x419e40
mov al, byte [esi + 0x7b]
test al, al
jne 0x419e40
push 0x4e20
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 0x4c]
mov edi, dword [esp + 0x50]
mov esi, ecx
cmp ecx, edi
je 0x419e85
mov edi, edi
mov ecx, dword [esp + 0x10]
push 1
push esi
call fcn.00424f40
mov ecx, esi
call fcn.0042c180
test al, al
je 0x419e7b
push 0xffffffffffffffff
push 0
lea eax, [esi + 0x68]
push eax
lea ecx, [esp + 0x84]
call fcn.004047c0
add esi, 0xc0
cmp esi, edi
jne 0x419e50
call fcn.004237c0
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [esp + 0x60], esp
push 9
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x5a96f4
mov word [ecx], ax
call fcn.00404a80
mov byte [esp + 0xbd8], 4
mov byte [esp + 0xbd8], 3
call fcn.004236a0
mov esi, dword [esp + 0x10]
cmp byte [esi + 0x10], 0
je 0x419ee1
push 3
push 0x5a9638
lea ecx, [esp + 0x68]
call fcn.00404880
cmp byte [esi + 0x11], 0
je 0x419ef7
push 3
push 0x5a9640
lea ecx, [esp + 0x68]
call fcn.00404880
cmp byte [esi + 0x12], 0
je 0x419f0d
push 3
push 0x5a9648
lea ecx, [esp + 0x68]
call fcn.00404880
mov eax, dword [esi + 0x70]
cmp byte [eax + 0x21], 0
je 0x419f26
push 3
push 0x5a9650
lea ecx, [esp + 0x68]
call fcn.00404880
cmp byte [esi + 0x14], 0
je 0x419f3c
push 3
push 0x5a9658
lea ecx, [esp + 0x68]
call fcn.00404880
push 0
push 0
push 0x3000
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
push 0x5a8420
lea edx, [esp + 0x64]
lea ecx, [esp + 0x34]
call fcn.0040cc70
add esp, 4
mov byte [esp + 0xbc0], 5
lea ecx, [esp + 0x78]
push ecx
mov edx, eax
lea ecx, [esp + 0xd0]
call fcn.004146d0
add esp, 4
mov byte [esp + 0xbc0], 7
cmp dword [esp + 0x44], 8
jb 0x419f9e
push dword [esp + 0x30]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x44], 7
mov word [esp + 0x30], ax
mov eax, dword [0x7e2178]
mov dword [esp + 0x40], 0
test al, 1
jne 0x419fe8
or eax, 1
mov dword [0x7e2178], eax
mov byte [esp + 0xbc0], 8
call fcn.004175a0
push 0x59fdc0
call fcn.00565027
add esp, 4
mov byte [esp + 0xbc0], 7
push 0
mov edx, 0x7e2184
lea ecx, [esp + 0xb8]
call fcn.004b1890
add esp, 4
mov byte [esp + 0xbc0], 9
lea edx, [esp + 0xcc]
push 0
lea ecx, [esp + 0xa0]
call fcn.004b1890
add esp, 4
mov byte [esp + 0xbc0], 0xa
lea eax, [esp + 0x1fc]
push 0x780
push 0
push eax
call fcn.0056cbb0
mov eax, dword [0x5a9668]
add esp, 0xc
movq xmm0, qword [0x5a9660]
mov dword [esp + 0x304], eax
mov ax, word [0x5a966c]
mov word [esp + 0x308], ax
mov eax, dword [0x7e2178]
movq qword [esp + 0x2fc], xmm0
test al, 1
jne 0x41a0a0
or eax, 1
mov dword [0x7e2178], eax
mov byte [esp + 0xbc0], 0xb
call fcn.004175a0
push 0x59fdc0
call fcn.00565027
add esp, 4
mov byte [esp + 0xbc0], 0xa
mov eax, dword [0x7e2178]
mov ecx, dword [0x7e2308]
cmp ecx, 6
jne 0x41a116
test al, 1
jne 0x41a0d9
or eax, 1
mov dword [0x7e2178], eax
mov byte [esp + 0xbc0], 0xc
call fcn.004175a0
push 0x59fdc0
call fcn.00565027
add esp, 4
mov byte [esp + 0xbc0], 0xa
cmp byte [0x7e2354], 0
je 0x41a0f8
movdqu xmm0, xmmword [str._jifen012_p6001]
movdqu xmmword [esp + 0x37c], xmm0
jmp 0x41a1e2
mov eax, dword [0x5a9688]
movq xmm0, qword [str._jifen012_p6]
mov dword [esp + 0x384], eax
mov al, byte [0x5a968c]
jmp 0x41a1d2
test al, 1
jne 0x41a14f
or eax, 1
mov dword [0x7e2178], eax
mov byte [esp + 0xbc0], 0xd
call fcn.004175a0
push 0x59fdc0
call fcn.00565027
add esp, 4
mov byte [esp + 0xbc0], 0xa
mov eax, dword [0x7e2178]
mov ecx, dword [0x7e2308]
cmp ecx, 7
jne 0x41a1b9
test al, 1
jne 0x41a182
or eax, 1
mov dword [0x7e2178], eax
mov byte [esp + 0xbc0], 0xe
call fcn.004175a0
push 0x59fdc0
call fcn.00565027
add esp, 4
mov byte [esp + 0xbc0], 0xa
cmp byte [0x7e2354], 0
je 0x41a19e
movdqu xmm0, xmmword [str._jifen012_p7001]
movdqu xmmword [esp + 0x37c], xmm0
jmp 0x41a1e2
mov eax, dword [0x5a96a8]
movq xmm0, qword [str._jifen012_p7]
mov dword [esp + 0x384], eax
mov al, byte [0x5a96ac]
jmp 0x41a1d2
mov eax, dword [0x5a96b8]
movq xmm0, qword [str._jifen012_p4]
mov dword [esp + 0x384], eax
mov al, byte [0x5a96bc]
movq qword [esp + 0x37c], xmm0
mov byte [esp + 0x388], al
mov eax, dword [str.jifen]
lea ecx, [esp + 0xb4]
cmp dword [esp + 0xc8], 0x10
lea edx, [esp + 0x57c]
movq xmm0, qword [str.jifen_heji]
cmovae ecx, dword [esp + 0xb4]
mov dword [esp + 0x3fc], eax
movzx eax, word [0x5a96c4]
mov word [esp + 0x400], ax
movzx eax, word [0x5a96d0]
mov word [esp + 0x484], ax
mov al, byte [0x5a96d2]
mov byte [esp + 0x486], al
mov eax, dword [str.000010]
mov dword [esp + 0x4fc], eax
movzx eax, word [0x5a96d8]
mov word [esp + 0x500], ax
mov al, byte [0x5a96da]
movq qword [esp + 0x47c], xmm0
mov byte [esp + 0x502], al
mov edi, edi
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx], al
lea edx, [edx + 1]
test al, al
jne 0x41a270
mov byte [esp + 0x97c], al
xorps xmm0, xmm0
mov byte [esp + 0x99b], al
xor eax, eax
push 0x208
push eax
mov word [esp + 0x9a4], ax
lea eax, [esp + 0x9a6]
push eax
movdqu xmmword [esp + 0x989], xmm0
mov dword [esp + 0x9a1], 0
movq qword [esp + 0x999], xmm0
mov word [esp + 0x9a5], 0
call fcn.0056cbb0
add esp, 0xc
lea eax, [esp + 0x99c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
sub esp, 0x18
lea edi, [esp + 0x70]
mov edx, esp
mov dword [esp + 0x60], esp
xor eax, eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], eax
mov dword [edx + 0x14], 7
mov dword [edx + 0x10], eax
mov word [edx], ax
cmp word [esp + 0x9b4], ax
jne 0x41a324
xor ecx, ecx
jmp 0x41a33f
lea ecx, [esp + 0x9b4]
lea esi, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41a330
sub ecx, esi
sar ecx, 1
push ecx
lea eax, [esp + 0x9b8]
mov ecx, edx
push eax
call fcn.00404a80
mov byte [esp + 0xbd8], 0xf
mov byte [esp + 0xbd8], 0xa
mov ecx, edi
call fcn.00409f60
push 0xa
lea eax, [esp + 0x998]
push eax
movzx eax, word [esp + 0x78]
imul ecx, eax, 0x64
movzx eax, word [esp + 0x7a]
add ecx, eax
push ecx
call fcn.00582e22
add esp, 0x24
xor ecx, ecx
lea ebx, [ebx]
mov al, byte [esp + ecx + 0x97c]
lea ecx, [ecx + 1]
mov byte [esp + ecx + 0x5fb], al
test al, al
jne 0x41a390
lea edi, [esp + 0x5fc]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x41a3b0
mov ax, word [0x5a96dc]
mov word [edi], ax
lea eax, [esp + 0x97c]
push 0xa
push eax
movzx eax, word [esp + 0x64]
push eax
call fcn.00582e22
lea edx, [esp + 0x988]
add esp, 0xc
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x41a3e4
lea edi, [esp + 0x5fc]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41a3f5
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x5fc]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x41a413
mov eax, dword [str..0.1]
lea edx, [esp + 0x77c]
cmp dword [esp + 0xb0], 0x10
movq xmm0, qword [str.software]
mov dword [ecx], eax
mov al, byte [0x5a96e4]
mov byte [ecx + 4], al
lea ecx, [esp + 0x9c]
mov al, byte [0x5a96f0]
cmovae ecx, dword [esp + 0x9c]
movq qword [esp + 0x6fc], xmm0
mov byte [esp + 0x704], al
mov al, byte [ecx]
lea edx, [edx + 1]
inc ecx
mov byte [edx - 1], al
test al, al
jne 0x41a467
mov eax, dword [0x7e257c]
test al, 1
jne 0x41a4fb
or eax, 1
mov dword [0x7e257c], eax
mov byte [esp + 0xbc0], 0x10
xor eax, eax
mov dword [0x7e2590], 0
mov dword [0x7e2594], 0
mov dword [0x7e2594], 7
mov dword [0x7e2590], 0
mov word [0x7e2580], ax
mov byte [esp + 0xbc0], 0x11
mov ecx, 0x7e2598
call fcn.004d3000
mov byte [esp + 0xbc0], 0x12
mov byte [0x7e2688], 1
mov byte [esp + 0xbc0], 0x10
push 0x5a01b0
call fcn.00565027
add esp, 4
mov byte [esp + 0xbc0], 0xa
push 1
push ecx
lea ecx, [esp + 0x204]
mov byte [0x7e2688], 0
call fcn.004cadd0
add esp, 8
mov dword [esp + 0x28], 0
xor eax, eax
mov dword [esp + 0x2c], 0
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], 0
push 9
push 0x5a96f4
mov word [esp + 0x20], ax
call fcn.00404a80
mov byte [esp + 0xbc0], 0x13
lea ecx, [esp + 0x18]
call fcn.004c9680
mov byte [esp + 0xbc0], 0xa
cmp dword [esp + 0x2c], 8
jb 0x41a577
push dword [esp + 0x18]
call fcn.00564de3
add esp, 4
sub esp, 0x18
mov dword [esp + 0x44], 7
mov ecx, esp
mov dword [esp + 0x60], esp
xor eax, eax
mov dword [esp + 0x40], 0
mov word [esp + 0x30], ax
push 9
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], eax
push 0x5a96f4
mov word [ecx], ax
call fcn.00404a80
mov byte [esp + 0xbd8], 0x14
mov byte [esp + 0xbd8], 0xa
call fcn.004236a0
mov byte [esp + 0xbc0], 9
cmp dword [esp + 0xb0], 0x10
jb 0x41a5e6
push dword [esp + 0x9c]
call fcn.00564de3
add esp, 4
mov dword [esp + 0xb0], 0xf
mov dword [esp + 0xac], 0
mov byte [esp + 0x9c], 0
mov byte [esp + 0xbc0], 7
cmp dword [esp + 0xc8], 0x10
jb 0x41a625
push dword [esp + 0xb4]
call fcn.00564de3
add esp, 4
mov dword [esp + 0xc8], 0xf
mov dword [esp + 0xc4], 0
mov byte [esp + 0xb4], 0
mov byte [esp + 0xbc0], 3
cmp dword [esp + 0xe0], 8
jb 0x41a664
push dword [esp + 0xcc]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0xe0], 7
mov dword [esp + 0xdc], 0
mov word [esp + 0xcc], ax
mov byte [esp + 0xbc0], 1
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x41a6d6
mov edi, dword [esp + 0x50]
mov esi, eax
cmp eax, edi
je 0x41a6b5
mov edi, edi
mov ecx, esi
call fcn.0040ba40
add esi, 0xc0
cmp esi, edi
jne 0x41a6a0
mov eax, dword [esp + 0x4c]
push eax
call fcn.00564de3
add esp, 4
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0
mov byte [esp + 0xbc0], 0
cmp dword [esp + 0x8c], 8
jb 0x41a6f4
push dword [esp + 0x78]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x8c], 7
mov dword [esp + 0x88], 0
mov word [esp + 0x78], ax
mov dword [esp + 0xbc0], 0xffffffff
cmp dword [esp + 0x74], 8
jb 0x41a72f
push dword [esp + 0x60]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x74], 7
mov dword [esp + 0x70], 0
mov word [esp + 0x60], ax
mov ecx, dword [esp + 0xbb8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0xba4]
xor ecx, esp
call fcn.00564de8
mov esp, ebp
pop ebp
ret