Function at 0x477cee
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x16c
push ebx
push esi
mov dword [esp + 0x1c], 0xa5c62e08
lea ecx, [esp + 0x74]
push edi
xor esi, esi
xor ebx, ebx
mov dword [esp + 0x20], esi
inc ebx
mov dword [esp + 0x20], 0xfffffffe
push 4
mov dword [esp + 0x24], 0x1c3c39ba
pop edi
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x20], edi
mov dword [esp + 0x20], 0xa0d461e3
mov dword [esp + 0x20], esi
push ebx
call fcn.0040194d
mov dword [esp + 0x10], esi
jmp 0x477d5c
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x168], 0x398
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x477d49
mov dword [esp + 0x10], esi
jmp 0x477d77
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x78]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jl 0x477d68
mov eax, dword [esp + 0x16c]
lea ecx, [esp + 0x78]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x78]
inc dword [eax]
call fcn.00401a1f
push ebx
lea ecx, [esp + 0x38]
call fcn.0040194d
mov dword [esp + 0x18], ebx
push 3
mov dword [esp + 0x20], 7
mov dword [esp + 0x14], esi
pop edx
jmp 0x477dca
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x34]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jl 0x477dbb
mov dword [esp + 0x10], esi
jmp 0x477de9
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x150], 0xfffffffc
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x477dd6
mov eax, dword [esp + 0x18]
xor edx, edx
mov eax, dword [esp + 0x34]
cmp dword [eax], esi
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x34]
setl dl
sub eax, dword [ecx]
mov edi, dword [ecx]
sub eax, edx
imul edx, eax, 3
xor ecx, ecx
mov eax, dword [esp + 0x18]
cmp edx, eax
setle cl
xor eax, eax
add ecx, edi
cmp ecx, edi
setl al
add eax, edi
je 0x477f0b
push 2
lea ecx, [esp + 0xc4]
call fcn.0040194d
mov dword [esp + 0x24], 0xfffffff7
lea ecx, [esp + 0xd8]
push ebx
call fcn.0040194d
mov dword [esp + 0x20], 0xf6f6d779
mov dword [esp + 0x10], esi
jmp 0x477e6e
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xc0]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x477e5c
mov dword [esp + 0x10], esi
jmp 0x477e91
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xd8]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jl 0x477e7b
mov dword [esp + 0x24], ebx
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xc0]
push 0
sub ecx, dword [eax + 4]
mov eax, dword [esp + 0xdc]
mov dword [eax], ecx
mov eax, dword [esp + 0x38]
pop ecx
setne cl
mov edi, dword [eax]
mov edx, edi
imul edx, ecx
neg edx
sbb edx, edx
xor eax, eax
neg edx
cmp edx, 6
setg al
xor ecx, ecx
sub eax, edi
cmp eax, edi
setl cl
xor eax, eax
cmp ecx, 0x72b4
lea ecx, [esp + 0xd8]
setl al
mov dword [esp + 0x20], eax
call fcn.00401a1f
lea ecx, [esp + 0xc0]
call fcn.00401a1f
jmp 0x477f22
mov dword [esp + 0x18], 0x4b76fef6
dec dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x158], eax
lea ecx, [esp + 0x34]
call fcn.00401a1f
mov dword [esp + 0x10], esi
lea ecx, [esp + 0x9c]
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x20], 0xfffffff8
push ebx
call fcn.0040194d
xor eax, eax
mov dword [esp + 0x1c], 0xde574131
mov dword [esp + 0x18], eax
jmp 0x477f72
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x9c]
mov dword [ecx + edx*4], 0x858f9c25
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
jl 0x477f5c
mov ecx, dword [esp + 0x24]
xor ebx, ebx
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
cmp edx, ecx
mov ecx, dword [esp + 0x24]
setne bl
add ecx, 0xfffffff6
add ecx, ebx
sub ecx, dword [esp + 0x20]
neg ecx
sbb ecx, ecx
inc ecx
cmp dword [esp + 0x10], ecx
jge 0x477fec
mov dword [esp + 0x18], eax
jmp 0x477fbc
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0x100], 9
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x477fa9
cmp dword [esp + 0x10c], eax
jne 0x477fd3
mov ecx, dword [esp + 0x10c]
mov edx, dword [esp + 0x10c]
mov ecx, dword [esp + 0x9c]
imul edx, dword [ecx]
neg edx
mov dword [esp + 0x20], edx
jmp 0x478043
mov dword [esp + 0x20], 7
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], al
je 0x478006
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor eax, eax
cmp dword [esp + 0x24], eax
je 0x478037
dec dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
add ecx, dword [esp + 0x1c]
je 0x478037
mov dword [esp + 0x10], 0xfffffff5
jmp 0x47802e
cmp dword [esp + 0x1c], eax
jne 0x478043
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x22
je 0x478024
jmp 0x478043
mov dword [esp + 0x20], 0xb4af
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], eax
jmp 0x47808e
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], 0
je 0x478062
push 0x19cb
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
mov dword [esp + 0x1c], eax
jmp 0x478084
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], 0
je 0x478080
push 0xea
call dword [sym.imp.GDI32.dll_GetStockObject]
xor eax, eax
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], eax
jle 0x478068
inc dword [esp + 0x10]
cmp dword [esp + 0x10], eax
jle 0x478049
lea ecx, [esp + 0x9c]
call fcn.00401a1f
mov dword [esp + 0x1c], 0xa72c25fc
lea ecx, [esp + 0xb4]
mov dword [esp + 0x20], 0x2e1dfe00
push 2
call fcn.0040194d
mov dword [esp + 0x24], 0x874be76d
xor eax, eax
mov dword [esp + 0x20], 0xba4d3ec9
mov dword [esp + 0x20], 0xfffffffe
mov dword [esp + 0x18], eax
jmp 0x4780f4
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0xb4]
mov dword [ecx + edx*4], 0xfffffff6
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x4780de
mov ecx, dword [esp + 0x1c]
xor edx, edx
mov dword [esp + 0x20], ecx
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
cmp ecx, 1
mov edi, dword [esp + 0xb4]
setle dl
xor ebx, ebx
imul edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
mov dword [edi + 4], esi
add edx, esi
cmp edx, ecx
mov ecx, dword [esp + 0x1c]
setne bl
xor edx, edx
cmp ebx, ecx
setle dl
cmp edx, 0x54fd
jge 0x47814d
cmp dword [esp + 0x24], eax
je 0x47814d
xor ecx, ecx
inc ecx
jmp 0x47814f
mov ecx, eax
cmp ecx, dword [esp + 0x1c]
jle 0x478161
cmp dword [edi + 4], eax
jne 0x478161
xor edi, edi
mov ecx, eax
inc edi
jmp 0x478166
xor edi, edi
inc edi
mov ecx, edi
mov eax, dword [esp + 0x1c]
add eax, ecx
lea ecx, [esp + 0xb4]
mov dword [esp + 0x20], eax
call fcn.00401a1f
xor eax, eax
mov dword [esp + 0x18], 7
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], eax
je 0x478203
push 2
mov dword [esp + 0x14], eax
pop ebx
jmp 0x4781be
mov dword [esp + 0x20], 0x6e6
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], 0
je 0x4781b6
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
xor eax, eax
mov ecx, dword [esp + 0x20]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jge 0x478199
mov dword [esp + 0x10], eax
jmp 0x4781f7
mov dword [esp + 0x20], 0x693e93
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], 0
je 0x4781e9
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
xor eax, eax
cmp dword [esp + 0x20], eax
jne 0x4782d0
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 5
jl 0x4781ca
jmp 0x4782d0
push dword [esp + 0x20]
movdqa xmm0, xmmword [0xa76f30]
lea ecx, [esp + 0x128]
push ecx
lea ecx, [esp + 0x11c]
mov dword [esp + 0x48], eax
push ecx
push eax
lea ecx, [esp + 0x50]
mov dword [esp + 0x54], eax
movdqu xmmword [esp + 0x124], xmm0
mov dword [esp + 0x58], eax
call fcn.00401a81
xor eax, eax
mov dword [esp + 0x20], 0xd99ea7eb
mov dword [esp + 0x18], eax
jmp 0x47825a
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0x28], edi
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x47824e
mov dword [esp + 0x10], 0xffffffff
jmp 0x4782bb
mov dword [esp + 0x20], edi
cmp dword [esp + 0x20], eax
je 0x478280
cmp dword [esp + 0x10], eax
je 0x478280
cmp dword [esp + 0x20], eax
jne 0x478288
mov esi, eax
cmp dword [esp + 0x28], eax
je 0x47828a
mov esi, edi
mov ecx, dword [esp + 0x28]
xor edx, edx
imul ecx, dword [esp + 0x28]
cmp ecx, 0xb0ae
mov ecx, dword [esp + 0x40]
setne dl
xor ebx, ebx
cmp esi, edx
sete bl
mov dword [ecx], ebx
xor ecx, ecx
cmp ebx, 0xfffffffd
sete cl
mov dword [esp + 0x20], ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 8
jl 0x47826a
lea ecx, [esp + 0x40]
call fcn.00401a1f
push 2
xor eax, eax
pop ebx
mov dword [esp + 0x10], eax
jmp 0x4782e6
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x2c], 0x3342eb9
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jl 0x4782d6
mov dword [esp + 0x10], eax
jmp 0x478302
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x70], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jl 0x4782f2
mov dword [esp + 0x30], eax
cmp dword [esp + 0x30], 0x10
je 0x478a13
push edi
lea ecx, [esp + 0x50]
call fcn.0040194d
xor eax, eax
mov dword [esp + 0x20], 0x4ddb
mov dword [esp + 0x18], eax
jmp 0x478340
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x4c]
mov dword [ecx + edx*4], eax
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x478331
mov ecx, dword [esp + 0x4c]
mov dword [ecx], eax
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], eax
jmp 0x478369
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0xf0], 0x5683c8fc
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
jl 0x478356
mov dword [esp + 0x1c], eax
jmp 0x478388
mov ecx, dword [esp + 0x1c]
mov dword [esp + ecx*4 + 0xf0], 0xd214c405
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ebx
jl 0x478375
mov ecx, dword [esp + 0x4c]
inc dword [ecx]
cmp dword [ecx], 0x11
jl 0x47834c
lea ecx, [esp + 0x4c]
call fcn.00401a1f
mov dword [esp + 0x10], 0xa205
lea ecx, [esp + 0xcc]
mov dword [esp + 0x20], 0xe125d16d
push 4
call fcn.0040194d
xor eax, eax
mov dword [esp + 0x18], eax
jmp 0x4783de
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0xcc]
mov dword [ecx + edx*4], 0xf4288a13
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x4783c8
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0xcc]
mov dword [ecx + 4], edx
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], al
je 0x47840a
push eax
push 0x20dd
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
lea ecx, [esp + 0xcc]
call fcn.00401a1f
mov dword [esp + 0x10], 0x173bf38c
xor eax, eax
mov dword [esp + 0x1c], 0xf0d3ecf0
mov dword [esp + 0x18], 0x41b44adc
mov dword [esp + 0x20], 3
cmp dword [esp + 0x10], eax
je 0x478485
mov ecx, dword [esp + 0x10]
xor edx, edx
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
cmp ecx, 0xfc36fe5
setl dl
mov dword [esp + 0x18], edx
cmp dword [esp + 0x18], eax
jne 0x47846b
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov edx, edi
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
neg ecx
cmp dword [esp + 0x10], ecx
je 0x478487
mov edx, eax
mov ecx, dword [esp + 0x10]
sub edx, ecx
cmp edx, dword [esp + 0x10]
jne 0x478497
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x20], ecx
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], al
je 0x4784c0
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
xor esi, esi
push esi
push esi
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov dword [esp + 0x1c], edi
lea ecx, [esp + 0xe4]
mov dword [esp + 0x20], 0xe125d16d
push 4
call fcn.0040194d
xor eax, eax
mov dword [esp + 0x18], eax
jmp 0x4784f8
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0xe4]
mov dword [ecx + edx*4], 0xf4288a13
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x4784e2
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0xe4]
mov dword [ecx + 4], edx
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], al
je 0x478524
push eax
push 0x20dd
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
lea ecx, [esp + 0xe4]
call fcn.00401a1f
mov dword [esp + 0x24], 0x2fd17ba7
lea ecx, [esp + 0x84]
mov dword [esp + 0x10], 0xb871c7bf
push ebx
call fcn.0040194d
xor eax, eax
mov dword [esp + 0x18], eax
jmp 0x47856b
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x84]
mov dword [ecx + edx*4], 0x24d8f3b1
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
jl 0x478555
cmp dword [esp + 0x10], eax
jne 0x4785ea
mov dword [esp + 0x18], edi
mov dword [esp + 0x20], 0xc59c3f90
mov ecx, dword [esp + 0x10]
cmp ecx, dword [esp + 0x10]
jne 0x4785ae
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
neg esi
sbb esi, esi
xor edx, edx
neg esi
cmp esi, ecx
setge dl
mov dword [esp + 0x20], edx
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, 0xd994
mov ecx, dword [esp + 0x18]
setle dl
xor ebx, ebx
cmp edx, ecx
setl bl
imul ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x84]
mov dword [ecx + 4], ebx
jmp 0x478672
mov dword [esp + 0x20], 0x531f145b
cmp dword [esp + 0x10], eax
je 0x4785fc
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
xor ebx, ebx
mov ecx, dword [esp + 0x10]
cmp edx, ecx
setle bl
imul ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x17], al
neg ebx
sbb ebx, ebx
neg ebx
sub ebx, ecx
je 0x47865c
cmp byte [esp + 0x17], al
je 0x478638
push edi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ShowOwnedPopups]
xor eax, eax
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], 0
je 0x478672
push 0x1ecb
push 0x15a3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
jmp 0x478670
cmp byte [esp + 0x17], al
je 0x478672
push eax
push eax
push 0xb7c
push eax
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
xor eax, eax
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], 0
je 0x47868f
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
lea ecx, [esp + 0x84]
call fcn.00401a1f
push 2
pop ebx
push ebx
lea ecx, [esp + 0x94]
call fcn.0040194d
xor eax, eax
mov dword [esp + 0x1c], 8
mov dword [esp + 0x18], eax
jmp 0x4786cd
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x90]
mov dword [ecx + edx*4], edi
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
jl 0x4786bb
mov dword [esp + 0x1c], eax
jmp 0x478702
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], 0
je 0x4786ee
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
xor eax, eax
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x90]
cmp dword [ecx + edx*4], eax
jne 0x478708
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jle 0x4786d9
lea ecx, [esp + 0x90]
call fcn.00401a1f
xor eax, eax
mov dword [esp + 0x18], eax
jmp 0x47872f
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0xf8], 0xb7e80d68
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
jl 0x47871c
mov ecx, dword [esp + 0x30]
neg ecx
sbb ecx, ecx
neg ecx
sub ecx, ebx
je 0x4789a0
mov dword [esp + 0x1c], 0xc75b57fd
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], edi
mov dword [esp + 0x18], eax
jmp 0x478770
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0x15c], 0x8ceffb91
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x47875d
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], 0x16
jne 0x478832
mov dword [esp + 0x18], 3
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
neg esi
sbb esi, esi
xor edx, edx
neg esi
cmp esi, ecx
setne dl
xor ebx, ebx
imul ecx, edx, 0x4adf
cmp ecx, 0x5eec80f2
mov ecx, dword [esp + 0x18]
setne bl
xor edx, edx
cmp ecx, ebx
setg dl
xor ecx, ecx
cmp edx, 0xfffffff8
setl cl
mov dword [esp + 0x15c], ecx
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
neg esi
sbb esi, esi
xor edx, edx
neg esi
cmp esi, ecx
setne dl
xor ebx, ebx
imul esi, edx, 0xef91391b
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
cmp ecx, edx
setge bl
xor ecx, ecx
cmp ebx, esi
setle cl
xor ebx, ebx
imul edx, ecx, 0xfec1
mov ecx, dword [esp + 0x10]
cmp edx, ecx
setne bl
mov dword [esp + 0x20], ebx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0x16
je 0x478786
push 2
pop ebx
push dword [esp + 0x20]
movdqa xmm0, xmmword [0xa76f70]
lea ecx, [esp + 0x148]
push ecx
lea ecx, [esp + 0x13c]
mov dword [esp + 0x6c], eax
push ecx
push eax
lea ecx, [esp + 0x74]
mov dword [esp + 0x78], eax
movdqu xmmword [esp + 0x144], xmm0
mov dword [esp + 0x7c], eax
call fcn.00401a81
push ebx
lea ecx, [esp + 0x5c]
call fcn.0040194d
mov dword [esp + 0x20], 0x5a83
lea ecx, [esp + 0xa8]
push edi
call fcn.0040194d
xor esi, esi
mov dword [esp + 0x10], esi
jmp 0x4788a7
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x58]
mov dword [eax + ecx*4], 0xa20bd035
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jl 0x478894
mov dword [esp + 0x10], esi
jmp 0x4788c9
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xa8]
mov dword [eax + ecx*4], 0x4d59ff44
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x4788b3
mov dword [esp + 0x10], esi
jmp 0x4788e8
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x144], 0x1c36b586
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x4788d5
mov ebx, dword [esp + 0x58]
xor ecx, ecx
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
cmp eax, dword [ebx + 4]
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x58]
setge cl
xor edx, edx
cmp ecx, eax
setl dl
xor eax, eax
sub edx, dword [edi]
cmp dword [ebx + 4], edx
sete al
xor ecx, ecx
cmp eax, 0x77045b3
mov eax, dword [esp + 0xa8]
setl cl
xor edx, edx
mov dword [eax], ecx
mov eax, dword [ebx + 4]
cmp dword [edi], eax
setge dl
xor ecx, ecx
add edx, eax
mov eax, dword [esp + 0x20]
cmp edx, eax
setge cl
mov dword [esp + 0x144], ecx
lea ecx, [esp + 0xa8]
call fcn.00401a1f
lea ecx, [esp + 0x58]
call fcn.00401a1f
inc dword [esp + 0x24]
mov dword [esp + 0x10], 0xfffffffa
jmp 0x478988
mov dword [esp + 0x1c], esi
jmp 0x47897d
cmp dword [esp + 0x74], esi
jne 0x478984
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jle 0x478973
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x31
je 0x47896d
lea ecx, [esp + 0x64]
call fcn.00401a1f
xor edi, edi
push 2
inc edi
pop ebx
jmp 0x478a02
mov dword [esp + 0x1c], 0x13
jmp 0x4789fb
mov dword [esp + 0x18], edi
cmp dword [esp + 0x18], eax
jl 0x4789f7
mov dword [esp + 0x10], eax
jmp 0x4789d8
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], 0
je 0x4789d4
push 0x427
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
xor eax, eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jle 0x4789ba
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + ecx*4 + 0xf8]
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0x70], edx
dec dword [esp + 0x18]
jns 0x4789b4
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jl 0x4789aa
inc dword [esp + 0x30]
cmp dword [esp + 0x30], 0x10
jne 0x478317
xor eax, eax
mov dword [esp + 0x10], 0xbe8e56f9
mov dword [esp + 0x18], eax
jmp 0x478a34
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0x110], 0x6bdde0bc
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x478a21
mov dword [esp + 0x10], eax
jmp 0x478aa8
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0xb7f37c04
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], eax
jl 0x478a7f
mov dword [esp + 0x18], eax
jmp 0x478a6b
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0x124], eax
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x478a5c
dec dword [esp + 0x128]
dec dword [esp + 0x1c]
jns 0x478a56
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], eax
jl 0x478aa4
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], 0
je 0x478a9e
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
xor eax, eax
dec dword [esp + 0x1c]
jns 0x478a89
inc dword [esp + 0x10]
cmp dword [esp + 0x10], eax
jle 0x478a40
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], 0
je 0x478ace
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret