Function at 0x405540
Capabilities:
Check os version

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5c7806
push eax
mov dword fs:[0], esp
sub esp, 0xa8
push ebp
push esi
mov esi, ecx
xor ebp, ebp
cmp dword [esi + 0xbc], ebp
je 0x405b11
mov eax, dword [esi + 0x1a00]
cmp eax, ebp
mov dword [esp + 0x10], eax
je 0x405596
mov eax, dword [esi + 0x1c]
push 1
push eax
call dword [sym.imp.USER32.dll_KillTimer]
push 1
mov ecx, esi
mov dword [esi + 0x1a00], ebp
call fcn.00405240
push ebx
push edi
mov dword [esp + 0x1c], vtable.CMenu.0
mov dword [esp + 0x20], ebp
mov dword [esp + 0xc0], ebp
call fcn.005b2355
mov eax, dword [eax + 0xc]
push 0x7d2
push eax
call dword [sym.imp.USER32.dll_LoadMenuA]
push eax
lea ecx, [esp + 0x20]
call fcn.005973ab
mov ecx, dword [esp + 0x20]
push ebp
push ecx
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call fcn.00597378
lea edx, [esp + 0x10]
mov dword [esi + 0x1a40], eax
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esi + 0x3c]
mov edi, dword [sym.imp.USER32.dll_DeleteMenu]
cmp eax, ebp
je 0x40560b
mov eax, dword [esi + 0x1a40]
push ebp
push 0x80ba
mov eax, dword [eax + 4]
push eax
call edi
mov eax, dword [esi + 0x44]
dec eax
cmp eax, 6
ja case.default.0x405618
jmp dword [eax*4 + 0x405b2c]
mov eax, dword [esi + 0x1a40]
push 0x400
push 4
mov ecx, dword [eax + 4]
push ecx
call edi
cmp dword [esi + 0x44], 4
je 0x40565c
mov eax, dword [esi + 0x1a40]
push ebp
push 0x80ba
mov edx, dword [eax + 4]
push edx
call edi
mov eax, dword [esi + 0x1a40]
push ebp
push 0x8010
mov eax, dword [eax + 4]
push eax
call edi
mov eax, dword [esi + 0x1a40]
push ebp
push 0x800e
mov ecx, dword [eax + 4]
push ecx
call edi
mov eax, dword [esi + 0x1a40]
push ebp
push 0x8011
mov edx, dword [eax + 4]
push edx
call edi
mov eax, dword [esi + 0x1a40]
push ebp
push 0xda
mov eax, dword [eax + 4]
push eax
call edi
cmp dword [esi + 0xcc], ebp
jne case.default.0x405618
mov eax, dword [esi + 0x1a40]
push ebp
push 0x8010
jmp 0x405758
mov eax, dword [esi + 0x48]
cmp eax, 0xfffffffe
je 0x4056bc
cmp eax, 0xffffffff
jne 0x4056cf
mov eax, dword [esi + 0x1a40]
push 0x400
push 4
mov edx, dword [eax + 4]
push edx
call edi
mov eax, dword [esi + 0x1a40]
push ebp
push 0x8011
mov eax, dword [eax + 4]
push eax
jmp 0x40575c
mov eax, dword [esi + 0x1a40]
push 0x400
push 4
mov edx, dword [eax + 4]
push edx
call edi
mov eax, dword [esi + 0x1a40]
push ebp
push 0x800c
mov eax, dword [eax + 4]
push eax
jmp 0x40575c
mov eax, dword [esi + 0x1a40]
push 0x400
push 4
mov ecx, dword [eax + 4]
push ecx
call edi
mov eax, dword [esi + 0x1a40]
push ebp
push 0x80ba
mov edx, dword [eax + 4]
push edx
call edi
mov eax, dword [esi + 0x1a40]
push ebp
push 0x8011
mov eax, dword [eax + 4]
push eax
call edi
mov eax, dword [esi + 0x1a2c]
cmp eax, ebp
jle case.default.0x405618
cmp eax, 3
jge case.default.0x405618
mov eax, dword [esi + 0x1a40]
push ebp
push 0xda
mov ecx, dword [eax + 4]
push ecx
call edi
cmp dword [esi + 0x3c], ebp
je 0x405775
mov eax, dword [esi + 0x1a40]
push ebp
push 0x800c
mov edx, dword [eax + 4]
push edx
call edi
mov eax, dword [esi + 0x1a40]
push 1
push 1
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.USER32.dll_SetMenuDefaultItem]
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], 0x94
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esp + 0x28]
xor eax, eax
cmp ecx, 4
ja 0x4057b0
jne 0x4057b5
cmp dword [esp + 0x2c], 0xa
jb 0x4057b5
mov eax, 0x4000
mov edx, dword [esi + 0x1c]
mov ecx, dword [esp + 0x14]
push ebp
push edx
mov edx, dword [esp + 0x18]
push ebp
push ecx
or eax, 0x102
push edx
push eax
mov eax, dword [esi + 0x1a40]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_TrackPopupMenu]
mov edx, dword [esp + 0x14]
mov ebx, dword [sym.imp.USER32.dll_SetCursorPos]
mov edi, eax
mov eax, dword [esp + 0x10]
push edx
push eax
call ebx
mov eax, dword [esi + 0x64]
mov dword [esi + 0x1a40], ebp
cmp eax, ebp
je 0x405805
push ebp
push ebp
mov ecx, esi
call fcn.004035d0
cmp edi, 0x800b
jg 0x40594b
je 0x40593d
cmp edi, 0x8008
jg 0x405912
je 0x405904
sub edi, 0xda
je 0x40585b
sub edi, 0x7f2b
je 0x40584f
sub edi, 2
jne case.0x405964.32785
push ebp
mov ecx, esi
call fcn.00405340
jmp case.0x405964.32785
mov dword [esi + 0x70], 2
jmp case.0x405964.32785
mov eax, dword [esi + 0x44]
mov dword [esp + 0x18], ebp
cmp eax, 1
mov dword [esi + 0xc8], 2
je 0x405876
cmp eax, 7
jne 0x4058ec
mov ecx, dword [esi + 0xb8]
push ecx
mov ecx, esi
call fcn.00403da0
mov edx, dword [esi + 0x4c]
mov eax, dword [esi + 0x50]
mov dword [esi + 0x1a10], edx
mov dword [esi + 0x1a14], eax
mov ecx, dword [esi + 0x54]
mov eax, dword [esi + 0x1a38]
mov dword [esi + 0x1a18], ecx
mov edx, dword [esi + 0x58]
push eax
mov ecx, esi
mov dword [esi + 0x1a1c], edx
call fcn.00402d40
mov ecx, dword [esi + 0x1a18]
mov edx, dword [esi + 0x1a1c]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], ecx
push eax
mov ecx, esi
mov dword [esi + 0x1a38], 0xffffffff
mov dword [esp + 0x18], edx
call fcn.00401a00
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push ecx
push edx
call ebx
mov dword [esi + 0x44], 6
mov dword [esi + 0x19fc], ebp
mov dword [esi + 0x1a2c], ebp
jmp 0x405ac1
push 1
mov ecx, esi
call fcn.00405340
jmp case.0x405964.32785
sub edi, 0x8009
je 0x40592f
dec edi
jne case.0x405964.32785
push 3
mov ecx, esi
call fcn.00405340
jmp case.0x405964.32785
push 2
mov ecx, esi
call fcn.00405340
jmp case.0x405964.32785
push 4
mov ecx, esi
call fcn.00405340
jmp case.0x405964.32785
lea eax, [edi - 0x800c]
cmp eax, 0xae
ja case.0x405964.32785
xor ecx, ecx
mov cl, byte [eax + 0x405b60]
jmp dword [ecx*4 + 0x405b48]
cmp dword [esi + 0xb8], ebp
je 0x40598a
cmp dword [esi + 0x1a2c], 2
jle 0x40598a
push 1
mov ecx, esi
call fcn.00403da0
jmp case.0x405964.32785
mov eax, 1
mov dword [esi + 0x70], eax
mov dword [esi + 0x6c], eax
jmp case.0x405964.32785
mov eax, 1
mov dword [esi + 0x19fc], ebp
mov dword [esp + 0x18], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x1a2c], ebp
push eax
jmp 0x405ac3
mov eax, dword [esi + 0x48]
mov dword [esi + 0x1a38], 0xffffffff
cmp eax, 0xfffffffe
mov dword [esp + 0x18], ebp
jne 0x4059d5
mov eax, 2
jmp 0x4059e2
xor edx, edx
cmp eax, 0xffffffff
setne dl
add edx, 3
mov eax, edx
mov dword [esi + 0x44], eax
mov eax, dword [esi + 0x5c]
cmp eax, ebp
mov dword [esi + 0x19fc], ebp
mov dword [esi + 0x1a2c], ebp
je 0x405ac1
jmp 0x405ab7
mov eax, dword [esi + 0x44]
mov dword [esp + 0x18], ebp
cmp eax, 1
jne 0x405a49
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x50]
mov dword [esi + 0x1a10], eax
mov dword [esi + 0x1a14], ecx
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x1a38]
mov dword [esi + 0x1a18], edx
mov eax, dword [esi + 0x58]
push ecx
mov ecx, esi
mov dword [esi + 0x1a1c], eax
call fcn.00402d40
mov dword [esi + 0x1a38], 0xffffffff
mov eax, dword [esi + 0x5c]
cmp eax, ebp
je 0x405a5a
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [esi + 0x5c], ebp
mov edx, dword [esi + 0x1a18]
mov eax, dword [esi + 0x1a1c]
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], edx
push ecx
mov ecx, esi
mov dword [esp + 0x18], eax
call fcn.00401a00
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push edx
push eax
call ebx
mov dword [esi + 0x44], 5
jmp 0x405ac1
mov eax, dword [esi + 0x5c]
mov dword [esi + 0x1a38], 0xffffffff
cmp eax, ebp
mov dword [esp + 0x18], ebp
mov dword [esi + 0x44], 7
mov dword [esi + 0x19fc], ebp
mov dword [esi + 0x1a2c], ebp
je 0x405ac1
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [esi + 0x5c], ebp
push 1
mov ecx, esi
call fcn.00401b70
push ebp
push ebp
mov ecx, esi
call fcn.004035d0
mov eax, dword [esp + 0x18]
pop edi
cmp eax, ebp
pop ebx
je 0x405af5
mov ecx, dword [esi + 0x1c]
push ebp
push 0x1f4
push 1
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [esi + 0x1a00], eax
mov dword [esp + 0x14], vtable.CMenu.0
lea ecx, [esp + 0x14]
mov dword [esp + 0xb8], 1
call fcn.00597402
mov ecx, dword [esp + 0xb0]
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0xb4
ret 0xc