Function at 0x476580
Capabilities:
Get common file path
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f6050
mov eax, dword fs:[0]
push eax
sub esp, 0x294
mov eax, dword [0x535a40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x224], edi
mov eax, dword [0x54f254]
push 0x50d198
push 0x54f764
mov dword [ebp - 0x234], eax
call fcn.004c9460
mov esi, eax
xor eax, eax
test esi, esi
push 0
setne al
lea eax, [eax*2 + 0x9f3f]
mov dword [ebp - 0x230], eax
call fcn.00452930
add esp, 0xc
cmp eax, 0x4563
jb 0x476681
push 0x50d1b0
push 0x54f764
call fcn.004c9460
add esp, 8
test eax, eax
jne 0x47661c
mov dword [ebp - 0x230], 0x9f40
jmp 0x476629
test esi, esi
je 0x476681
call fcn.00478020
test al, al
je 0x476681
call fcn.00447450
push 0
push 0x50d1b0
mov ecx, eax
call fcn.00448770
call fcn.00447510
mov esi, eax
mov ecx, esi
call fcn.004456b0
mov ecx, esi
mov dword [edi + 0x94], eax
call fcn.00445610
mov esi, dword [sym.imp.USER32.dll_GetSysColor]
push 0xd
mov dword [edi + 0x98], eax
call esi
push 0xe
mov dword [edi + 0x9c], eax
call esi
mov dword [edi + 0xa0], eax
mov dword [edi + 0xa4], 0x404040
call fcn.004486b0
test al, al
jne 0x47668f
call fcn.0044b5c0
mov eax, dword [edi + 4]
mov dword [ebp - 0x228], eax
mov eax, dword [0x532518]
test eax, eax
jne 0x4766a6
mov dword [0x532518], eax
lea edx, [edi + 0x2f4]
mov dword [ebp - 0x22c], edx
test edx, edx
je 0x47674f
cmp word [0x532528], 0
jne 0x476b1a
push 0x530324
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp word [0x532528], 0
jne 0x476b03
mov eax, dword [0x532518]
test eax, eax
je 0x476a3a
mov ecx, dword [0x5324f0]
mov esi, dword [0x532510]
mov dword [ebp - 0x21c], ecx
lea ecx, [ebp - 0x270]
push ecx
push eax
push 0
mov dword [ebp - 0x270], 0x30
call dword [sym.imp.USER32.dll_GetClassInfoExW]
test eax, eax
jne 0x4769f0
lea eax, [ebp - 0x270]
push eax
push dword [0x532518]
push dword [0x56a3d4]
call dword [sym.imp.USER32.dll_GetClassInfoExW]
test eax, eax
jne 0x4769f0
mov eax, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x530324
call eax
xor eax, eax
push 0
push eax
push 0
push 0
push 0x56000000
push 0
push 0x53034c
push dword [ebp - 0x228]
lea ecx, [edi + 0x2d4]
call fcn.0045e5c0
and byte [edi + 0x411], 0xfe
lea ecx, [edi + 0x35c]
mov dword [edi + 0x2c], eax
mov eax, dword [edi + 0x2d8]
mov dword [ebp - 0x21c], eax
mov eax, dword [0x532488]
mov dword [ebp - 0x220], ecx
test eax, eax
jne 0x4767a5
mov dword [0x532488], eax
add ecx, 0x20
mov dword [ebp - 0x22c], ecx
je 0x476846
cmp word [0x532498], 0
jne 0x476c5c
push 0x530324
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp word [0x532498], 0
jne 0x476c46
mov eax, dword [0x532488]
test eax, eax
je 0x476b7b
mov ecx, dword [0x532460]
mov edi, dword [0x532480]
mov esi, dword [sym.imp.USER32.dll_GetClassInfoExW]
mov dword [ebp - 0x228], ecx
lea ecx, [ebp - 0x270]
push ecx
push eax
push 0
mov dword [ebp - 0x270], 0x30
call esi
test eax, eax
jne 0x476b31
lea eax, [ebp - 0x270]
push eax
push dword [0x532488]
push dword [0x56a3d4]
call esi
test eax, eax
jne 0x476b31
push 0x530324
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
mov ecx, dword [ebp - 0x220]
push 0
push eax
push 0
push 0
push 0x56000000
push 0
push 0x53034c
push dword [ebp - 0x21c]
call fcn.0045e5c0
mov edi, dword [sym.imp.KERNEL32.dll_MulDiv]
push 0x60
push dword [0x53a8bc]
mov dword [ebp - 4], 0
push 0x10
call edi
push 0x60
push dword [0x53a8bc]
mov esi, eax
push 0x10
call edi
push 3
push 3
push 0x21
push esi
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_Create]
mov esi, eax
push 0
push 0x37
mov dword [ebp - 0x22c], esi
call fcn.0043b050
mov edi, dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
add esp, 8
push eax
push 0xffffffffffffffff
push esi
call edi
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x50d1c4
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.004d6355
add esp, 0xc
mov dword [ebp - 0x238], 0
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x218]
push eax
push dword [0x56a3d4]
call dword [sym.imp.SHELL32.dll_ExtractAssociatedIconW]
push eax
push 0xffffffffffffffff
push esi
call edi
push 0x60
push dword [0x53a8bc]
push 0x10
call dword [sym.imp.KERNEL32.dll_MulDiv]
push 0x60
push dword [0x53a8bc]
mov edi, eax
push 0x10
call dword [sym.imp.KERNEL32.dll_MulDiv]
push 0
push edi
push eax
push 1
push 0xb9
push dword [0x56a3d8]
call dword [sym.imp.USER32.dll_LoadImageW]
push eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
push esi
mov edi, dword [ebp - 0x224]
push 0
push 0x1303
push dword [edi + 0x380]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [edi + 0x360]
lea esi, [edi + 0x418]
mov dword [ebp - 0x220], eax
mov ecx, 0x532578
lea eax, [esi + 0x20]
push eax
call fcn.004647c0
movzx eax, ax
mov dword [ebp - 0x21c], eax
mov eax, dword [esi + 0x14]
test eax, eax
jne 0x476c73
call fcn.004c17e4
mov dword [esi + 0x14], eax
test eax, eax
jne 0x476c73
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [edi + 0x35c]
push eax
push dword [edi + 0x2d8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 4]
call fcn.0048b710
add esp, 0x18
test eax, eax
jns 0x476d22
or eax, 0xffffffff
jmp 0x477087
movups xmm0, xmmword [ebp - 0x260]
mov eax, dword [ebp - 0x21c]
movups xmm1, xmmword [ebp - 0x270]
movups xmmword [0x5324f8], xmm0
movups xmm0, xmmword [ebp - 0x250]
movups xmmword [0x5324e8], xmm1
mov dword [0x5324f0], eax
psrldq xmm1, 8
movups xmmword [0x532508], xmm0
mov dword [0x532510], esi
movd dword [0x53251c], xmm1
jmp 0x476a62
mov eax, dword [0x56a3d8]
xor ecx, ecx
cmp dword [0x532524], ecx
push dword [0x532520]
cmovne eax, ecx
push eax
call dword [sym.imp.USER32.dll_LoadCursorW]
mov esi, dword [0x532510]
mov dword [0x532504], eax
and dword [0x5324ec], 0xffffbfff
mov eax, dword [0x56a3d4]
mov dword [0x5324fc], eax
test esi, esi
jne 0x476aa7
push 0x5324e8
push 0x501c30
push 0x25
push 0x53252a
call fcn.00415290
mov eax, dword [0x5324fc]
add esp, 0x10
mov dword [0x532510], 0x53252a
mov esi, 0x53252a
movups xmm0, xmmword [0x5324e8]
lea ecx, [ebp - 0x2a0]
push ecx
movups xmmword [ebp - 0x2a0], xmm0
push esi
movups xmm0, xmmword [0x5324f8]
push eax
movups xmmword [ebp - 0x290], xmm0
movups xmm0, xmmword [0x532508]
movups xmmword [ebp - 0x280], xmm0
call dword [sym.imp.USER32.dll_GetClassInfoExW]
movzx eax, ax
mov word [0x532528], ax
test ax, ax
jne 0x476b03
push 0x5324e8
push 0x530320
call fcn.0045dc90
mov word [0x532528], ax
mov eax, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x530324
call eax
mov eax, dword [0x532518]
mov edx, dword [ebp - 0x22c]
test eax, eax
je 0x476b25
mov eax, dword [0x53251c]
mov dword [edx], eax
movzx eax, word [0x532528]
jmp 0x476751
movups xmm0, xmmword [ebp - 0x260]
mov eax, dword [ebp - 0x228]
movups xmm1, xmmword [ebp - 0x270]
movups xmmword [0x532468], xmm0
movups xmm0, xmmword [ebp - 0x250]
movups xmmword [0x532458], xmm1
mov dword [0x532460], eax
psrldq xmm1, 8
movups xmmword [0x532478], xmm0
mov dword [0x532480], edi
movd dword [0x53248c], xmm1
jmp 0x476ba9
mov eax, dword [0x56a3d8]
xor ecx, ecx
cmp dword [0x532494], ecx
push dword [0x532490]
cmovne eax, ecx
push eax
call dword [sym.imp.USER32.dll_LoadCursorW]
mov edi, dword [0x532480]
mov esi, dword [sym.imp.USER32.dll_GetClassInfoExW]
mov dword [0x532474], eax
and dword [0x53245c], 0xffffbfff
mov eax, dword [0x56a3d4]
mov dword [0x53246c], eax
test edi, edi
jne 0x476bee
push 0x532458
push 0x501c30
push 0x25
push 0x53249a
call fcn.00415290
mov eax, dword [0x53246c]
add esp, 0x10
mov dword [0x532480], 0x53249a
mov edi, 0x53249a
movups xmm0, xmmword [0x532458]
lea ecx, [ebp - 0x2a0]
push ecx
movups xmmword [ebp - 0x2a0], xmm0
push edi
movups xmm0, xmmword [0x532468]
push eax
movups xmmword [ebp - 0x290], xmm0
movups xmm0, xmmword [0x532478]
movups xmmword [ebp - 0x280], xmm0
call esi
movzx eax, ax
mov word [0x532498], ax
test ax, ax
jne 0x476c46
push 0x532458
push 0x530320
call fcn.0045dc90
mov word [0x532498], ax
push 0x530324
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x532488]
mov ecx, dword [ebp - 0x22c]
test eax, eax
je 0x476c67
mov eax, dword [0x53248c]
mov dword [ecx], eax
movzx eax, word [0x532498]
jmp 0x476848
push 0
push 0
push eax
call fcn.004c18e6
cmp word [ebp - 0x21c], 0
je 0x4769bf
add esi, 8
je 0x4770a4
lea eax, [edi + 0x418]
test eax, eax
je 0x4770a4
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x530324
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x53033c]
mov dword [esi + 8], eax
push 0x530324
mov dword [0x53033c], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x530350]
lea eax, [edi + 0x418]
mov edx, dword [0x53034c]
push 0
push dword [0x56a3d4]
push eax
push dword [ebp - 0x220]
mov eax, dword [0x530358]
sub eax, ecx
push eax
mov eax, dword [0x530354]
sub eax, edx
push eax
mov eax, dword [ebp - 0x21c]
push ecx
push edx
push 0x56000000
push 0
movzx eax, ax
push eax
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
jmp 0x4769bf
mov eax, dword [0x54feb0]
lea esi, [edi + 0x2a8]
mov dword [ebp - 0x21c], eax
mov ecx, esi
mov eax, dword [esi]
mov eax, dword [eax + 8]
call eax
mov dword [ebp - 0x220], eax
mov eax, dword [esi + 0x14]
test eax, eax
jne 0x476d55
call fcn.004c17e4
mov dword [esi + 0x14], eax
test eax, eax
je 0x476d89
push esi
push dword [ebp - 0x220]
push eax
call fcn.004c18e6
push dword [esi + 0x14]
call fcn.004c1849
push eax
push 0xfffffffffffffffc
push dword [ebp - 0x21c]
call dword [sym.imp.USER32.dll_SetWindowLongW]
test eax, eax
je 0x476d89
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x21c]
mov dword [esi + 4], eax
mov esi, dword [edi + 0x41c]
push 0
push 0
push 0x1304
push dword [edi + 0x380]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 2
push 0x50d1dc
push esi
push eax
lea ecx, [edi + 0x35c]
call fcn.00476250
mov eax, dword [0x56a2e4]
push dword [edi + 4]
mov dword [edi + 0x24], eax
mov eax, dword [0x54feb0]
mov dword [edi + 0x28], eax
call dword [sym.imp.USER32.dll_GetMenu]
push eax
lea ecx, [edi + 0x6c]
mov dword [ebp - 0x228], eax
call fcn.00475930
mov ecx, edi
call fcn.00475df0
mov eax, dword [0x54fea4]
lea esi, [edi + 0x2f8]
mov dword [esi + 4], eax
mov ecx, esi
mov eax, dword [edi + 0x360]
mov dword [esi + 8], eax
call fcn.004659d0
movsd xmm0, qword [0x54b0b0]
mulsd xmm0, qword [0x50b100]
push 0x64
push CreateSecurityPage
cvttsd2si eax, xmm0
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
cmp byte [esi], 0
mov edx, dword [esi + 0x38]
mov dword [ebp - 0x220], eax
mov dword [esi + 0x44], eax
mov eax, dword [esi + 0x2c]
je 0x476e45
mov ecx, dword [esi + 0x14]
sub ecx, dword [esi + 0xc]
jmp 0x476e4b
mov ecx, dword [esi + 0x18]
sub ecx, dword [esi + 0x10]
sub ecx, eax
sub ecx, edx
test ecx, ecx
jle 0x476e73
push CreateSecurityPage
push ecx
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_MulDiv]
push 0
push eax
mov ecx, esi
mov byte [esi + 0x48], 0
call fcn.00465050
mov ecx, esi
call fcn.004659d0
cmp byte [0x54f258], 0
jne 0x476ec5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
jne 0x476ea1
push 5
push dword [esi + 4]
call eax
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi + 8]
call eax
cmp dword [esi + 0x28], 0
je 0x476eb5
mov dword [esi + 0x28], 0
mov ecx, esi
mov dword [esi + 0x50], 0
call fcn.004659d0
jmp 0x476ee8
push dword [ebp - 0x234]
lea ecx, [edi + 0x35c]
call fcn.00464e90
lea eax, [ebp - 0x234]
mov ecx, edi
push eax
push 0
push 0
call fcn.004776f0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
mov ecx, 0x56a394
call fcn.00475d30
mov esi, eax
mov eax, dword [esi + 8]
mov edx, dword [esi + 0xc]
cmp eax, edx
jne 0x476f70
mov ecx, dword [esi + 4]
lea edi, [ebp - 0x23c]
cmp edi, ecx
mov edi, dword [ebp - 0x224]
jb 0x476f32
lea edi, [ebp - 0x23c]
lea eax, [ecx + edx*4]
cmp edi, eax
mov edi, dword [ebp - 0x224]
jb 0x4770b0
mov eax, dword [esi + 8]
test edx, edx
jne 0x476f43
mov eax, 1
mov dword [ebp - 0x21c], eax
jmp 0x476f54
add eax, eax
mov dword [ebp - 0x21c], eax
js 0x476f85
cmp eax, 0x1fffffff
ja 0x476f85
push 4
push eax
push ecx
call fcn.004d714f
add esp, 0xc
test eax, eax
je 0x476f85
mov ecx, dword [ebp - 0x21c]
mov dword [esi + 0xc], ecx
mov dword [esi + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [esi + 4]
lea eax, [eax + ecx*4]
test eax, eax
je 0x476f82
lea ecx, [edi + 0x34]
mov dword [eax], ecx
inc dword [esi + 8]
mov eax, dword [esi + 0x14]
lea edx, [edi + 0x38]
mov ecx, dword [esi + 0x18]
cmp eax, ecx
jne 0x477000
mov edx, dword [esi + 0x10]
lea edi, [ebp - 0x240]
cmp edi, edx
mov edi, dword [ebp - 0x224]
jb 0x476fbf
lea edi, [ebp - 0x240]
lea eax, [edx + ecx*4]
cmp edi, eax
mov edi, dword [ebp - 0x224]
jb 0x4770ba
mov eax, dword [esi + 0x14]
test ecx, ecx
jne 0x476fd0
mov eax, 1
mov dword [ebp - 0x21c], eax
jmp 0x476fe1
add eax, eax
mov dword [ebp - 0x21c], eax
js 0x477012
cmp eax, 0x1fffffff
ja 0x477012
push 4
push eax
push edx
call fcn.004d714f
add esp, 0xc
test eax, eax
je 0x477012
mov ecx, dword [ebp - 0x21c]
lea edx, [edi + 0x38]
mov dword [esi + 0x18], ecx
mov dword [esi + 0x10], eax
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x10]
lea eax, [eax + ecx*4]
test eax, eax
je 0x47700f
mov dword [eax], edx
inc dword [esi + 0x14]
push 0
push dword [ebp - 0x230]
push 0x9f41
push 0x9f3f
push dword [ebp - 0x228]
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
push dword [edi + 4]
xor esi, esi
mov eax, 8
cmp byte [0x54f258], 0
cmovne esi, eax
call dword [sym.imp.USER32.dll_GetMenu]
push esi
push 0x9c6e
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
movzx eax, byte [0x54f258]
push eax
push 0x9c6e
push 0x402
push dword [0x54feb4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
mov ecx, edi
call fcn.004655d0
mov byte [edi + 0x4f8], 1
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c34b7
mov esp, ebp
pop ebp
ret 0x10
push 1
push 0xc0000005
call fcn.00445580
push 0x80004005
call fcn.0042d270
push 0x80004005
call fcn.0042d270
int3