Function at 0x475a4f
Capabilities:
Check os version
Get common file path
Get system information on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x240
push esi
push edi
mov dword [esp + 0x38], ecx
xor eax, eax
mov dword [esp + 0x40], eax
xor edi, edi
mov dword [esp + 0x1c], 0x38a1f949
inc edi
mov dword [esp + 0x14], 0xf6e229ed
mov dword [esp + 0x18], 0x66bc657e
mov dword [esp + 0xc], edi
mov dword [esp + 0x20], 0x70e7ad53
push 5
mov dword [esp + 0x38], edx
pop edx
cmp dword [esp + 0x1c], eax
jne 0x475b40
mov ecx, dword [esp + 0x1c]
sub ecx, edx
mov dword [esp + 0x14], ecx
jne 0x475ab3
mov esi, eax
cmp dword [esp + 0x14], eax
je 0x475ab5
mov esi, edi
mov ecx, dword [esp + 0x1c]
xor edx, edx
cmp esi, ecx
setl dl
mov dword [esp + 0x18], edx
xor edx, edx
mov ecx, dword [esp + 0x18]
cmp ecx, 0x6f9b
mov ecx, dword [esp + 0x1c]
setl dl
mov dword [esp + 0x2c], edx
xor edx, edx
cmp dword [esp + 0x2c], ecx
setle dl
mov dword [esp + 0xc], edx
mov ecx, dword [esp + 0xc]
sub ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x1c]
neg ecx
sbb ecx, ecx
inc ecx
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, 0xfc65
setg cl
sub ecx, 4
jne 0x475b18
mov edx, eax
cmp dword [esp + 0x18], eax
je 0x475b1a
mov edx, edi
mov ecx, dword [esp + 0x1c]
imul ecx, edx
mov dword [esp + 0x20], ecx
cmp dword [esp + 0x20], eax
jne 0x475b40
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x475b54
push eax
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
xor eax, eax
jmp 0x475b54
mov dword [esp + 0x24], 0xfffffff7
mov dword [esp + 0x2c], 0x84edc02
inc dword [esp + 0x2c]
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [esp + 0x20], eax
jmp 0x475c01
mov dword [esp + 0x14], eax
jmp 0x475b78
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x21c], edi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x475b69
mov dword [esp + 0xc], eax
jmp 0x475b9e
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x475b9a
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
xor eax, eax
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0x12
jg 0x475b85
mov dword [esp + 0x18], eax
jmp 0x475bf6
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x475bca
push eax
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectPalette]
xor eax, eax
mov dword [esp + 0xc], eax
jmp 0x475beb
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x475be7
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
xor eax, eax
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jle 0x475bd0
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jle 0x475bab
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 0x19
jle 0x475b63
mov ecx, dword [0xa794d8]
test cl, 1
jne 0x475c96
push eax
or ecx, edi
mov dword [0xa794e0], eax
push eax
mov dword [0xa794d8], ecx
mov dword [0xa794e4], eax
call fcn.00426955
mov ecx, eax
mov dword [0xa794fc], 0x3f800000
mov dword [0xa794e0], ecx
xor eax, eax
mov dword [esp + 0x84], ecx
lea ecx, [esp + 0x84]
push ecx
push 0x10
push eax
mov dword [0xa794e8], eax
mov ecx, 0xa794e8
mov dword [0xa794f0], eax
mov dword [0xa794ec], eax
lea eax, [esp + 0xb8]
push eax
call fcn.004266fa
push 0x485b20
mov dword [0xa794f4], 7
mov dword [0xa794f8], 8
call fcn.004796cf
pop ecx
mov edi, dword [sym.imp.GDI32.dll_CreateFontA]
mov dword [esp + 0x24], 0x4a6847df
mov byte [esp + 0x13], 0
cmp byte [esp + 0x13], 0
je 0x475cf2
push 0
push 0x2584
push 0xe88
push 0x6bc
push 0x2037
push 0x24ad
push 0x2278
push 0x4f8
push 0x24a1
push 0x151c
push 0x19c7
push 0x19d7
push 0x848
push 0x42
call edi
mov byte [esp + 0x13], 0
cmp byte [esp + 0x13], 0
je 0x475d06
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
imul eax, dword [esp + 0x38], 0x2710
lea ecx, [esp + 0x14c]
push 2
add eax, dword [esp + 0x38]
mov dword [esp + 0x48], eax
call fcn.0040194d
push 3
lea ecx, [esp + 0xcc]
call fcn.0040194d
xor eax, eax
mov dword [esp + 0xc], eax
jmp 0x475d50
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x14c]
mov dword [ecx + edx*4], 0x98a8
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x475d3a
mov dword [esp + 0xc], eax
jmp 0x475d73
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0xc8]
mov dword [ecx + edx*4], 0x94a18885
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x475d5d
mov ecx, dword [esp + 0xc8]
mov dword [ecx], 1
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x475dd5
push eax
push 0x2584
push 0xe88
push 0x6bc
push 0x2037
push 0x24ad
push 0x2278
push 0x4f8
push 0x24a1
push 0x151c
push 0x19c7
push 0x19d7
push 0x848
push 0x42
call edi
xor eax, eax
mov edx, dword [esp + 0xc8]
mov ecx, dword [esp + 0x14c]
mov esi, dword [edx]
cmp dword [ecx + esi*4], eax
jne 0x475df3
lea ecx, [esi - 1]
mov dword [edx], ecx
test ecx, ecx
jns 0x475d87
lea ecx, [esp + 0xc8]
call fcn.00401a1f
lea ecx, [esp + 0x14c]
call fcn.00401a1f
lea eax, [esp + 0x44]
push eax
call fcn.0047778f
xor esi, esi
lea ecx, [esp + 0xbc]
inc esi
push 2
mov edi, dword [eax]
mov dword [esp + 0x10], 0x62e0
mov dword [esp + 0x20], 0xcdf9c775
mov dword [esp + 0x1c], 0xbefcdf11
mov dword [esp + 0x24], esi
call fcn.0040194d
xor eax, eax
mov dword [esp + 0x30], 0xfffd
mov dword [esp + 0x14], eax
jmp 0x475e6a
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0xbc]
mov dword [ecx + edx*4], 0x1eb64d07
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x475e54
mov ecx, dword [esp + 0xc]
xor edx, edx
test ecx, ecx
push 0xfffffffffffffffd
setns dl
xor ecx, ecx
add edx, dword [esp + 0x10]
cmp edx, 0xfb66
pop edx
setne cl
sub ecx, dword [esp + 0x1c]
add ecx, dword [esp + 0xc]
mov dword [esp + 0x18], ecx
imul ecx, dword [esp + 0x18], 0x5ac3
push 0
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
sub edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x20]
cmp edx, 0xffffffff
sbb edx, edx
neg edx
cmp edx, ecx
mov edx, dword [esp + 0x10]
pop ecx
setge cl
sub edx, ecx
cmp dword [esp + 0x18], 0xd41e5596
mov ecx, dword [esp + 0xbc]
mov dword [ecx], edx
jne 0x475f0f
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x47602f
push 0xc1c
push eax
push eax
push eax
push eax
push 0x1679
push 0x9c5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindowEx]
jmp 0x47602f
mov dword [esp + 0xc], 0x93d7f285
mov dword [esp + 0x18], 0x19
jmp 0x476024
mov dword [esp + 0x28], 0xfffc
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], 0x29ef
mov dword [esp + 0x14], eax
jmp 0x475f51
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0xec], 4
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x475f3e
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0xbc]
push 0
cmp edx, dword [ecx]
pop ecx
setl cl
mov dword [esp + 0xec], ecx
mov ecx, dword [esp + 0x28]
neg ecx
je 0x475f99
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0xf4]
mov esi, dword [esp + 0xec]
mov ecx, dword [esp + 0x30]
dec esi
neg esi
push 0
sbb esi, esi
xor edx, edx
neg esi
cmp esi, ecx
mov ecx, dword [esp + 0x10]
setge dl
cmp edx, ecx
pop edx
setne dl
sub edx, dword [esp + 0xf4]
mov ecx, dword [esp + 0x24]
neg edx
sbb edx, edx
inc edx
sub edx, ecx
xor ecx, ecx
cmp edx, 0x4a3a207b
setg cl
add ecx, 0x3620
je 0x475fe7
mov ecx, dword [esp + 0x2c]
mov ecx, dword [esp + 0xc]
mov edx, 0x9588dfef
cmp edx, ecx
mov ecx, dword [esp + 0xc]
sbb esi, esi
xor edx, edx
inc esi
cmp esi, ecx
setge dl
cmp edx, 0xc53a
jg 0x47600c
mov ecx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x1c]
xor esi, esi
inc esi
mov edx, esi
sub edx, ecx
mov ecx, dword [esp + 0xbc]
mov dword [ecx], edx
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 9
jne 0x475f24
lea ecx, [esp + 0xbc]
call fcn.00401a1f
xor eax, eax
test edi, edi
je 0x47624a
mov dword [esp + 0xc], 7
mov dword [esp + 0x28], 0xfffffff7
mov dword [esp + 0xc], 0xffffffe7
cmp dword [esp + 0xc], 0xffffffe5
jl 0x4760fb
mov dword [esp + 0x24], 0xfffffffd
mov dword [esp + 0x14], eax
jmp 0x476085
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x1ac], esi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x476076
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x1ac]
mov ecx, dword [esp + 0x1b4]
dec ecx
jne 0x4760a9
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
xor edx, edx
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x28], 3
mov ecx, dword [esp + 0x1ac]
cmp ecx, 0x5da2ca33
push 5
setg dl
xor ecx, ecx
cmp edx, 0x859
pop edx
setg cl
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x24]
cmp edx, ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x24], ecx
dec dword [esp + 0xc]
jmp 0x47605d
push dword [esp + 0xac]
movdqa xmm0, xmmword [0xa76f80]
lea ecx, [esp + 0x1f0]
push ecx
lea ecx, [esp + 0x1e4]
mov dword [esp + 0x14], esi
push ecx
mov dword [esp + 0x38], 0x9b8fa48a
lea ecx, [esp + 0xbc]
push eax
mov dword [esp + 0x7c], edi
movdqu xmmword [esp + 0x1ec], xmm0
mov dword [esp + 0xc0], eax
mov dword [esp + 0xc4], eax
mov dword [esp + 0xc8], eax
call fcn.00401a81
mov dword [esp + 0x2c], esi
xor esi, esi
mov dword [esp + 0x24], 9
mov dword [esp + 0xc], esi
cmp dword [esp + 0xc], 0x18
jne 0x47623e
mov esi, dword [esp + 0xb0]
push 6
pop edi
xor ecx, ecx
mov dword [esp + 0x28], 1
mov eax, dword [esp + 0xc]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x28]
test eax, eax
mov eax, dword [esp + 0xc]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0xc]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0xc]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0xc]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0xc]
setle cl
xor edx, edx
mov dword [esi + 8], ecx
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
cmp ecx, eax
setne dl
cmp edi, edx
sbb ecx, ecx
xor eax, eax
neg ecx
sub ecx, 0x12eba948
cmp ecx, 0x5f0e77da
setl al
xor ecx, ecx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
cmp eax, 0x3b5b0d6
setl cl
xor edx, edx
imul ecx, dword [esp + 0xc]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0xc]
cmp ecx, eax
setge dl
add edx, 0x55d4
imul edx, dword [esp + 0xc]
neg edx
sbb edx, edx
neg edx
mov dword [esp + 0x24], edx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0x18
je 0x47617c
lea ecx, [esp + 0xb0]
jmp 0x4776c1
mov dword [esp + 0x24], 0x464b
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x476266
push eax
push eax
call dword [sym.imp.USER32.dll_LoadMenuW]
xor eax, eax
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x476279
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
mov ecx, dword [0xa794d8]
test cl, 2
jne 0x4762fe
push eax
or ecx, 2
mov dword [0xa79500], eax
push eax
mov dword [0xa794d8], ecx
mov dword [0xa79504], eax
call fcn.00426955
mov ecx, eax
mov dword [0xa7951c], 0x3f800000
mov dword [0xa79500], ecx
xor eax, eax
mov dword [esp + 0x40], ecx
lea ecx, [esp + 0x40]
push ecx
push 0x10
push eax
mov dword [0xa79508], eax
mov ecx, 0xa79508
mov dword [0xa79510], eax
mov dword [0xa7950c], eax
lea eax, [esp + 0xa8]
push eax
call fcn.004266fa
push 0x485b1b
mov dword [0xa79514], 7
mov dword [0xa79518], 8
call fcn.004796cf
pop ecx
mov dword [esp + 0x14], 4
mov dword [esp + 0x28], 0xdedb
mov dword [esp + 0x2c], esi
mov dword [esp + 0x2c], 0x310fecaf
mov dword [esp + 0x24], 0xc752f67d
mov eax, dword [esp + 0x14]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [esp + 0x28]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, 0xe056
setle dl
cmp dword [esp + 0x14], 2
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, edx
setg cl
xor eax, eax
mov dword [esp + 0x24], ecx
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x476383
push 0x49f
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
xor eax, eax
push dword [esp + 0x9c]
lea ecx, [esp + 0x1e0]
mov dword [esp + 0x4c], eax
push ecx
xorps xmm0, xmm0
mov dword [esp + 0x54], eax
lea ecx, [esp + 0x1d4]
mov dword [esp + 0x58], eax
push ecx
movdqu xmmword [esp + 0x68], xmm0
lea ecx, [esp + 0x54]
movdqa xmm0, xmmword [0xa76f90]
push eax
movdqu xmmword [esp + 0x1dc], xmm0
call fcn.00401a81
xor esi, esi
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x1c], esi
push 3
pop esi
cmp dword [esp + 0x1c], esi
jg 0x4764f8
mov edi, dword [esp + 0x48]
mov dword [esp + 0x2c], 0xe779066
lea ecx, [esp + 0x134]
push esi
call fcn.0040194d
xor eax, eax
mov dword [esp + 0xc], eax
jmp 0x476416
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x3c], 0xa955a63a
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 1
jl 0x476406
mov dword [esp + 0xc], eax
jmp 0x476439
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x134]
mov dword [ecx + edx*4], 8
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x476423
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x48]
cmp dword [ecx + edx*4], eax
je 0x47645b
cmp dword [esp + 0x3c], eax
je 0x47645b
xor esi, esi
inc esi
jmp 0x47645d
mov esi, eax
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x48]
push 0
cmp dword [ecx + edx*4], esi
mov ecx, 0xeec80f21
pop edx
setl dl
sub ecx, edx
xor edx, edx
cmp ecx, 0x6fdd8fb8
setne dl
cmp edx, dword [esp + 0x2c]
jne 0x47648a
mov ecx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x3c]
xor edx, edx
mov ecx, dword [esp + 0x3c]
imul ecx, dword [esp + 0x3c], 0xd365
cmp ecx, dword [edi + 4]
mov ecx, 0xffff
setle dl
cmp ecx, edx
sbb ecx, ecx
neg ecx
cmp ecx, 0xc36544d1
ja 0x4764c8
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x48]
cmp dword [ecx + edx*4], eax
jne 0x4764c8
cmp dword [esp + 0x1c], eax
je 0x4764cb
xor eax, eax
inc eax
imul ecx, eax, 0xfff9
mov eax, dword [esp + 0x134]
mov dword [eax + 8], ecx
lea ecx, [esp + 0x134]
call fcn.00401a1f
inc dword [esp + 0x1c]
push 3
pop esi
cmp dword [esp + 0x1c], esi
jle 0x4763e9
lea ecx, [esp + 0x48]
call fcn.00401a1f
lea eax, [esp + 0x38]
push eax
call fcn.004777f1
cmp byte [ebp + 0xc], 0
mov ecx, dword [eax]
mov dword [esp + 0x2c], ecx
jne 0x47651f
test ecx, ecx
jne 0x476938
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 0x3d4a1cf0
mov dword [esp + 0x14], eax
jmp 0x476546
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x228], 0x6d0c11e0
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x476533
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
cmp dword [esp + 0x18], eax
je 0x476563
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x14], 1
mov dword [esp + 0x14], esi
cmp dword [esp + 0x14], eax
jl 0x47659d
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x476597
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
xor eax, eax
dec dword [esp + 0x14]
jns 0x476581
mov dl, byte [ebp + 0xc]
lea eax, [esp + 0x238]
mov ecx, dword [esp + 0x38]
push eax
call fcn.0046076f
mov esi, eax
lea edi, [esp + 0x60]
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor esi, esi
mov dword [esp + 0x14], 0xea5d6c05
inc esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x14], 0
jmp 0x476736
push esi
lea ecx, [esp + 0x168]
call fcn.0040194d
push esi
lea ecx, [esp + 0xd8]
call fcn.0040194d
xor eax, eax
mov dword [esp + 0x1c], esi
mov dword [esp + 0xc], eax
jmp 0x476614
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x164]
mov dword [ecx + edx*4], 0xe0b4074d
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x4765fe
mov dword [esp + 0xc], eax
jmp 0x476636
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0xd4]
mov dword [ecx + edx*4], 0x66f5a9c4
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x476620
mov ecx, dword [esp + 0xd4]
mov dword [ecx], eax
mov dword [esp + 0x20], 0x2121f90e
mov dword [esp + 0x20], eax
cmp dword [esp + 0x20], eax
jl 0x476709
mov dword [esp + 0x30], eax
mov ecx, 0xffff
mov dword [esp + 0x18], 0x46b4
mov dword [esp + 0xc], 0x491ba6b4
mov dword [esp + 0x28], 0xfa4c8210
cmp dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x30]
sbb edx, edx
neg edx
cmp edx, ecx
push 0
pop ecx
setg cl
xor edx, edx
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x1c]
cmp dword [esp + 0x30], ecx
setg dl
cmp edx, dword [esp + 0x18]
jl 0x4766b1
cmp dword [esp + 0xc], eax
jne 0x4766b1
mov esi, eax
jmp 0x4766b4
xor esi, esi
inc esi
mov edx, dword [esp + 0x20]
xor ecx, ecx
cmp esi, 0x3c6f
setne cl
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x164]
mov ecx, dword [ecx + edx*4]
sub ecx, dword [esp + 0x30]
neg ecx
sbb ecx, ecx
neg ecx
mov dword [esp + 0x28], ecx
cmp dword [esp + 0x28], eax
jne 0x4766f2
cmp dword [esp + 0x18], eax
jne 0x4766f2
xor esi, esi
mov ecx, eax
inc esi
jmp 0x4766f7
xor esi, esi
inc esi
mov ecx, esi
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x20]
dec dword [esp + 0x20]
jns 0x47665b
mov ecx, dword [esp + 0xd4]
inc dword [ecx]
cmp dword [ecx], eax
jle 0x476645
lea ecx, [esp + 0xd4]
call fcn.00401a1f
lea ecx, [esp + 0x164]
call fcn.00401a1f
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jne 0x4765d8
cmp byte [ebp + 0xc], 0
je 0x476938
cmp dword [esp + 0x64], 0
je 0x476938
push 2
pop ecx
mov dword [esp + 0x14], 0xb26bdde0
push 6
mov dword [esp + 0x1c], 0xfffffffb
mov dword [esp + 0x18], 0
pop edi
cmp dword [esp + 0x14], ecx
jge 0x47678b
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x188], edi
inc dword [esp + 0x14]
jmp 0x476774
mov dword [esp + 0x14], 0
cmp dword [esp + 0x14], 0xffffffea
jl 0x4767eb
push 0xfffffffffffffffd
pop edx
mov dword [esp + 0x18], 0xfb6318d5
mov dword [esp + 0x18], 0xfffffff1
jmp 0x4767da
mov dword [esp + 0x20], edx
mov dword [esp + 0x20], 0
jmp 0x4767d0
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x188], 0x4ccb63e8
inc dword [esp + 0x20]
cmp dword [esp + 0x20], ecx
jl 0x4767bd
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jg 0x4767af
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xffffffea
jge 0x47679d
mov eax, dword [esp + 0x68]
lea ecx, [esp + 0x104]
mov dword [esp + 0x1c], 0xffffffff
push esi
mov dword [esp + 0x74], eax
call fcn.0040194d
mov dword [esp + 0x28], 0x4df8e3bf
xor eax, eax
mov dword [esp + 0x20], 0x435
mov dword [esp + 0x14], eax
jmp 0x476836
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x104]
mov dword [ecx + edx*4], 0x3638
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x476820
mov dword [esp + 0x1c], 0x11
jmp 0x47691a
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x14], 0xaf6082f4
mov dword [esp + 0x30], 7
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], eax
jl 0x476881
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x104]
cmp dword [ecx + edx*4], eax
jne 0x476881
dec dword [esp + 0xc]
jns 0x47686b
cmp dword [esp + 0xc], 0xfffffffa
push 0
sbb esi, esi
neg esi
sub esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x10]
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp esi, ecx
mov ecx, dword [esp + 0x2c]
setge dl
cmp edx, ecx
pop ecx
setge cl
xor edx, edx
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x1c]
cmp dword [esp + 0x24], ecx
setg dl
cmp edx, 7
je 0x4768cd
cmp dword [esp + 0xc], eax
jne 0x4768cd
xor esi, esi
mov ecx, eax
inc esi
jmp 0x4768d2
xor esi, esi
inc esi
mov ecx, esi
cmp dword [esp + 0xc], ecx
jg 0x4768dc
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
xor edx, edx
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
cmp ecx, esi
setg dl
cmp edx, 2
jg 0x476910
mov ecx, eax
cmp dword [esp + 0x1c], eax
je 0x476912
mov ecx, esi
mov dword [esp + 0xc], ecx
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
je 0x476849
lea ecx, [esp + 0x104]
call fcn.00401a1f
mov eax, dword [esp + 0x64]
mov dword [esp + 0x74], eax
xor esi, esi
xor eax, eax
inc esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x28], 4
mov dword [esp + 0x20], 0xfffffffc
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x476969
push eax
push eax
push 0x16f6
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [esp + 0x18], 0xfffffff6
jmp 0x476a85
mov dword [esp + 0x1c], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], 0xf7d26684
mov dword [esp + 0x30], 0x6920
mov dword [esp + 0x1c], 0xfffffffb
jmp 0x476a76
push 4
lea ecx, [esp + 0x114]
call fcn.0040194d
xor eax, eax
mov dword [esp + 0x14], eax
jmp 0x4769c7
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x110]
mov dword [ecx + edx*4], 0xd2038e85
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x4769b1
cmp dword [esp + 0x1c], eax
je 0x4769e2
mov dword [esp + 0x28], eax
mov dword [esp + 0x14], esi
cmp dword [esp + 0x28], eax
jne 0x4769e6
mov dword [esp + 0x14], eax
mov edi, dword [esp + 0x110]
cmp dword [edi + 4], eax
je 0x476a3c
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
cmp ecx, edx
push 0
pop edx
setle dl
xor ecx, ecx
cmp edx, 0xffffffff
setge cl
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x28]
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
sub esi, 2
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp esi, ecx
setge dl
xor ecx, ecx
cmp edx, dword [edi + 4]
setle cl
xor esi, esi
inc esi
cmp ecx, dword [esp + 0x18]
mov ecx, esi
je 0x476a3e
mov ecx, eax
cmp ecx, dword [esp + 0x18]
jl 0x476a4c
mov ecx, eax
cmp dword [esp + 0x1c], eax
je 0x476a4e
mov ecx, esi
mov eax, dword [esp + 0x20]
sub ecx, eax
sub ecx, dword [esp + 0x20]
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [esp + 0x14]
mov dword [esp + 0x30], ecx
lea ecx, [esp + 0x110]
call fcn.00401a1f
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0x11
jg 0x47699b
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jge 0x476976
mov edi, dword [esp + 0x2c]
test edi, edi
jne 0x47711f
cmp dword [esp + 0x5c], edi
jle 0x47711f
xor eax, eax
mov dword [esp + 0x14], 0x91a049fe
mov dword [esp + 0x14], eax
jmp 0x476ac9
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x210], 0xf84b8114
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x476ab6
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x476ae3
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
xor eax, eax
mov dword [esp + 0x14], eax
jmp 0x476af9
mov dword [esp + 0x28], 7
dec dword [esp + 0x28]
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xfffffff2
jge 0x476ae9
mov dword [esp + 0xc], eax
lea ecx, [esp + 0x128]
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x20], 0xfffffff8
push esi
call fcn.0040194d
xor eax, eax
mov dword [esp + 0x1c], 0xde574131
mov dword [esp + 0x14], eax
jmp 0x476b47
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x128]
mov dword [ecx + edx*4], 0x858f9c25
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x476b31
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
cmp edx, ecx
mov ecx, dword [esp + 0x28]
push 0
pop edx
setne dl
add ecx, 0xfffffff6
add ecx, edx
sub ecx, dword [esp + 0x20]
neg ecx
sbb ecx, ecx
inc ecx
cmp dword [esp + 0xc], ecx
jge 0x476bc2
mov dword [esp + 0x14], eax
jmp 0x476b92
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x19c], 9
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x476b7f
cmp dword [esp + 0x1a8], eax
jne 0x476ba9
mov ecx, dword [esp + 0x1a8]
mov edx, dword [esp + 0x1a8]
mov ecx, dword [esp + 0x128]
imul edx, dword [ecx]
neg edx
mov dword [esp + 0x20], edx
jmp 0x476c19
mov dword [esp + 0x24], 7
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x476bdc
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor eax, eax
cmp dword [esp + 0x28], eax
je 0x476c0d
dec dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
add ecx, dword [esp + 0x1c]
je 0x476c0d
mov dword [esp + 0xc], 0xfffffff5
jmp 0x476c04
cmp dword [esp + 0x1c], eax
jne 0x476c19
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0x22
je 0x476bfa
jmp 0x476c19
mov dword [esp + 0x24], 0xb4af
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], eax
jmp 0x476c64
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x476c38
push 0x19cb
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
mov dword [esp + 0x1c], eax
jmp 0x476c5a
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x476c56
push 0xea
call dword [sym.imp.GDI32.dll_GetStockObject]
xor eax, eax
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], eax
jle 0x476c3e
inc dword [esp + 0xc]
cmp dword [esp + 0xc], eax
jle 0x476c1f
lea ecx, [esp + 0x128]
call fcn.00401a1f
mov dword [esp + 0x20], 0x3c69aed2
lea ecx, [esp + 0xf8]
push esi
call fcn.0040194d
mov dword [esp + 0x24], 0x1c77dcd
push 5
pop eax
mov dword [esp + 0x24], 0x5b65ab4d
mov dword [esp + 0x24], eax
xor eax, eax
mov dword [esp + 0xc], eax
jmp 0x476cc0
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0xf8]
mov dword [ecx + edx*4], 0x1ff29acd
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x476caa
mov dword [esp + 0xc], eax
jmp 0x476cdf
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x88], 0xfffffff9
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x476ccc
mov dword [esp + 0xc], eax
jmp 0x476cff
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0xe0], 0xfff6
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x476cec
mov ecx, dword [esp + 0x20]
mov edx, 0x23b1a956
sub edx, ecx
jne 0x476d24
mov ecx, dword [esp + 0x20]
cmp edx, ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [esp + 0x20]
jl 0x476d24
mov esi, eax
mov ecx, dword [esp + 0x20]
xor edx, edx
cmp ecx, 7
setl dl
xor ecx, ecx
cmp edx, esi
setl cl
xor edx, edx
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x20]
cmp dword [esp + 0x24], ecx
mov ecx, dword [esp + 0xf8]
setg dl
mov dword [ecx], edx
inc dword [esp + 0xe0]
cmp dword [esp + 0xe4], eax
je 0x476d6d
cmp dword [esp + 0x88], eax
je 0x476d6d
xor eax, eax
inc eax
xor ecx, ecx
cmp eax, 0xffffffff
mov eax, dword [esp + 0xe8]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x8c]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x88]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x20]
setle dl
xor ecx, ecx
cmp eax, 1
setle cl
xor eax, eax
cmp ecx, edx
setle al
imul ecx, eax, 0x17ba
mov eax, dword [esp + 0xf8]
mov dword [eax], ecx
lea ecx, [esp + 0xf8]
call fcn.00401a1f
push 3
lea ecx, [esp + 0x180]
call fcn.0040194d
push 2
mov dword [esp + 0x18], 0
pop esi
cmp dword [esp + 0x14], 3
jge 0x476e01
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x17c]
mov dword [eax + ecx*4], esi
inc dword [esp + 0x14]
jmp 0x476de6
mov byte [esp + 0x13], 0
cmp byte [esp + 0x13], 0
je 0x476e1c
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov byte [esp + 0x13], 0
cmp byte [esp + 0x13], 0
je 0x476e30
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea ecx, [esp + 0x17c]
call fcn.00401a1f
mov dword [esp + 0x24], 0xb319
xor eax, eax
mov dword [esp + 0x24], 0x5c8094a
mov dword [esp + 0x24], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x24], 1
mov dword [esp + 0x24], 0x36f6dd8d
mov dword [esp + 0x24], 0x693e93
mov dword [esp + 0x24], 0xfffffffb
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 0x1b0ae28d
mov dword [esp + 0xc], eax
jmp 0x476e9b
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x1f8], 1
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x476e88
mov dword [esp + 0xc], eax
jmp 0x476eba
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x208], 0xffffffff
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x476ea7
dec dword [esp + 0x28]
cmp dword [esp + 0x60], eax
je 0x47711f
mov dword [esp + 0xc], 0xbeaa32b1
mov dword [esp + 0x1c], 0x7102d149
mov dword [esp + 0x18], 0xfffffffa
mov dword [esp + 0x14], eax
jmp 0x476efc
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x54], 0x47d1afd0
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x476eec
mov ecx, dword [esp + 0xc]
mov edx, 0xc865b49d
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
sub edx, ecx
mov dword [esp + 0x58], edx
mov esi, dword [esp + 0xc]
mov ecx, dword [esp + 0x1c]
add esi, edx
xor edx, edx
cmp ecx, esi
push 0
setne dl
mov dword [esp + 0x20], edx
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x5c]
mov ecx, dword [esp + 0x1c]
cmp edx, ecx
mov edx, dword [esp + 0x10]
pop ecx
setle cl
sub edx, ecx
mov ecx, dword [esp + 0xc]
cmp edx, ecx
push 0
pop ecx
setge cl
sub ecx, dword [esp + 0xc]
je 0x4770c8
mov dword [esp + 0x20], 0x1826fbd1
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x476f89
mov dword [esp + 0x18], eax
jmp 0x4770de
mov dword [esp + 0x20], 0xfffffffa
lea ecx, [esp + 0x190]
push 1
call fcn.0040194d
xor esi, esi
mov dword [esp + 0x14], esi
jmp 0x477157
push dword [esp + 0x14]
lea ecx, [esp + 0x194]
call fcn.00401379
mov dword [eax], 0x24cd
inc dword [esp + 0x14]
xor ecx, ecx
inc ecx
cmp dword [esp + 0x14], ecx
jl 0x47713d
mov dword [esp + 0x20], 0xffffffe4
jmp 0x477195
mov dword [esp + 0x14], esi
jmp 0x47717f
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1ec], ecx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x477170
mov eax, dword [esp + 0x20]
mov dword [esp + 0x1ec], eax
inc dword [esp + 0x20]
cmp dword [esp + 0x20], ecx
jne 0x47716a
lea ecx, [esp + 0x190]
call fcn.00401a1f
lea ecx, [esp + 0x5c]
call fcn.004621dd
test edi, edi
je 0x47742a
xor edi, edi
mov dword [esp + 0x18], 0xfd4914d2
inc edi
lea ecx, [esp + 0x170]
push edi
call fcn.0040194d
push edi
lea ecx, [esp + 0x15c]
call fcn.0040194d
push 3
lea ecx, [esp + 0x144]
call fcn.0040194d
mov dword [esp + 0xc], esi
jmp 0x477207
push dword [esp + 0xc]
lea ecx, [esp + 0x174]
call fcn.00401379
mov dword [eax], edi
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x4771f1
mov dword [esp + 0xc], esi
jmp 0x477229
push dword [esp + 0xc]
lea ecx, [esp + 0x15c]
call fcn.00401379
mov dword [eax], esi
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x477213
mov dword [esp + 0xc], esi
jmp 0x47724b
push dword [esp + 0xc]
lea ecx, [esp + 0x144]
call fcn.00401379
mov dword [eax], edi
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x477235
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x170]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
push esi
call fcn.00401379
xor ecx, ecx
push esi
cmp dword [eax], esi
setne cl
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x15c]
call fcn.00401379
mov ecx, dword [esp + 0x24]
mov edi, eax
xor eax, eax
push esi
cmp ecx, dword [edi]
lea ecx, [esp + 0x144]
sete al
mov dword [esp + 0x28], eax
call fcn.00401379
mov ecx, dword [esp + 0x18]
xor edx, edx
sub ecx, dword [esp + 0x24]
cmp ecx, dword [eax]
lea ecx, [esp + 0x140]
mov eax, dword [edi]
setge dl
mov dword [esp + 0x18], edx
mov dword [esp + 0x18], eax
call fcn.00401a1f
lea ecx, [esp + 0x158]
call fcn.00401a1f
lea ecx, [esp + 0x170]
call fcn.00401a1f
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x2c]
call fcn.00475a45
movdqa xmm0, xmmword [0xa76f20]
lea ecx, [esp + 0x200]
mov dword [esp + 0x6c], eax
lea eax, [esp + 0x1cc]
push eax
lea eax, [esp + 0x1c0]
push eax
movdqu xmmword [esp + 0x1c4], xmm0
call fcn.00401a3e
push ecx
lea ecx, [esp + 0x7c]
push dword [eax + 4]
push dword [eax]
call fcn.004019f9
mov dword [esp + 0x18], 1
mov dword [esp + 0x24], 0x1e60
mov dword [esp + 0x18], 3
cmp dword [esp + 0x18], esi
jl 0x477411
mov dword [esp + 0x14], 0xc25fa5fe
lea ecx, [esp + 0x78]
mov dword [esp + 0x24], 0xfffffff9
push dword [esp + 0x18]
call fcn.00401379
push dword [esp + 0x18]
lea ecx, [esp + 0x7c]
mov edi, eax
call fcn.00401379
mov ecx, dword [edi]
sub ecx, dword [eax]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x14], ecx
jne 0x4773e4
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x14], 3
jae 0x4773ae
cmp dword [esp + 0x14], esi
je 0x4773ae
xor edi, edi
inc edi
jmp 0x4773b0
mov edi, esi
push 1
lea ecx, [esp + 0x7c]
call fcn.00401379
mov ecx, dword [esp + 0x14]
sub edi, ecx
cmp edi, dword [eax]
jg 0x4773d0
cmp dword [esp + 0x14], esi
je 0x4773d0
xor edi, edi
inc edi
jmp 0x4773d2
mov edi, esi
push esi
lea ecx, [esp + 0x7c]
call fcn.00401379
cmp edi, dword [eax]
jle 0x4773e4
xor eax, eax
jmp 0x4773e7
xor eax, eax
inc eax
mov dword [esp + 0x24], eax
mov byte [esp + 0x13], 0
cmp byte [esp + 0x13], 0
je 0x477404
push 0x1f3e
push 0
call dword [sym.imp.USER32.dll_CharLowerBuffW]
dec dword [esp + 0x18]
push 0
pop esi
jns 0x477359
lea ecx, [esp + 0x78]
call fcn.00401a1f
lea eax, [esp + 0x44]
push eax
call fcn.0047778f
mov ecx, dword [esp + 0x6c]
mov dword [eax], ecx
push 3
lea ecx, [esp + 0x94]
call fcn.0040194d
push 2
pop edi
mov dword [esp + 0xc], 0xffffffff
lea ecx, [esp + 0x11c]
push edi
call fcn.0040194d
mov dword [esp + 0x34], 1
mov dword [esp + 0xc], 0
jmp 0x47747c
push dword [esp + 0xc]
lea ecx, [esp + 0x94]
call fcn.00401379
mov dword [eax], 0x7f82
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x477462
mov dword [esp + 0xc], 0
jmp 0x4774a7
push dword [esp + 0xc]
lea ecx, [esp + 0x120]
call fcn.00401379
mov dword [eax], 0xfffffffd
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x47748d
mov dword [esp + 0xc], 0
jmp 0x477686
mov dword [esp + 0x20], 0x4b25b3b9
mov dword [esp + 0x14], 0xe135e1f6
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x20], edi
cmp dword [esp + 0x20], 0
jl 0x477662
mov dword [esp + 0x18], 8
mov dword [esp + 0x18], 0
jmp 0x4774ff
mov dword [esp + 0x14], 0x4f3d4e6
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jle 0x4774f3
mov esi, dword [esp + 0x20]
lea ecx, [esp + 0x11c]
push 0
call fcn.00401379
mov edx, dword [esp + 0x20]
lea ecx, [esi + 0x4b5a]
mov edi, eax
xor eax, eax
cmp ecx, edx
setne al
imul eax, dword [esp + 0x18]
mov dword [edi], esi
neg eax
sbb eax, eax
xor esi, esi
neg eax
cmp eax, dword [esp + 0xc]
jl 0x477546
cmp dword [esp + 0x1c], esi
je 0x477546
inc esi
mov eax, dword [esp + 0xc]
xor ecx, ecx
cmp esi, eax
sete cl
xor edx, edx
neg ecx
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
cmp ecx, eax
lea ecx, [esp + 0x90]
setge dl
mov dword [esp + 0x34], edx
push dword [esp + 0xc]
call fcn.00401379
mov ecx, dword [esp + 0x34]
add ecx, dword [eax]
jne 0x477586
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
xor ecx, ecx
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x20]
cmp dword [edi], eax
push dword [esp + 0xc]
sete cl
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x94]
call fcn.00401379
mov ecx, dword [esp + 0x24]
cmp ecx, dword [eax]
je 0x477643
push 5
pop eax
push 2
mov dword [esp + 0x34], eax
mov dword [esp + 0x20], 0
pop edi
jmp 0x477614
mov dword [esp + 0x24], 0x8a0c0902
mov dword [esp + 0x14], edi
cmp dword [esp + 0x14], 0
jl 0x47760c
mov byte [esp + 0x13], 0
cmp byte [esp + 0x13], 0
je 0x477606
push 0x2390
push 0x245
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
xor esi, esi
push esi
call dword [sym.imp.USER32.dll_GetMessageA]
dec dword [esp + 0x14]
jns 0x4775e0
mov eax, dword [esp + 0x24]
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jle 0x4775cd
push dword [esp + 0xc]
lea ecx, [esp + 0x94]
call fcn.00401379
mov ecx, dword [esp + 0x30]
xor edx, edx
cmp ecx, 6
setne dl
xor ecx, ecx
cmp edx, dword [eax]
setg cl
mov dword [esp + 0x14], ecx
jmp 0x477655
mov dword [esp + 0x24], 0xfffc
cmp dword [esp + 0x24], 0
jne 0x47765f
push 2
pop edi
dec dword [esp + 0x20]
jns 0x4774e1
push 2
pop edi
mov byte [esp + 0x13], 0
cmp byte [esp + 0x13], 0
je 0x477682
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jle 0x4774ba
mov byte [esp + 0x13], 0
cmp byte [esp + 0x13], 0
je 0x4776ae
push 0x19ac
push 0xee3
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
lea ecx, [esp + 0x11c]
call fcn.00401a1f
lea ecx, [esp + 0x90]
call fcn.00401a1f
mov eax, dword [ebp + 8]
lea esi, [esp + 0x6c]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov esp, ebp
pop ebp
ret