Function at 0x57ef20
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38c
mov eax, dword [0x64e0a0]
xor eax, ebp
mov dword [ebp - 4], eax
fld dword [0x650d1c]
push ebx
fldz
push esi
fucomp st(1)
mov esi, ecx
push edi
mov dword [ebp - 0x36c], esi
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x24c], 0
fnstsw ax
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x244], 0
test ah, 0x44
jp 0x57ef80
fstp st(0)
mov eax, 0x11
jmp 0x57ef8b
fmul qword [0x6226c8]
call fcn.00549020
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esi + 0xa4], eax
lea eax, [esi + 0xac]
push eax
push 0
push 0x1010
push dword [esi + 0x20]
mov dword [esi + 0xa8], 0
call edi
mov ecx, esi
call fcn.0042d21c
push 0x100
push 0
push 0x1036
push dword [esi + 0x20]
mov dword [esi + 0x74], eax
call edi
mov ecx, 0xe
mov esi, str.OOOOOOOOOO____XX_O____X__OO__XX___O__X____OOXX_____OX___
lea edi, [ebp - 0x40]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0xe
mov esi, str.___OX_____OOXX____O__X___OO__XX__O____X_OO____XXOXXXXXXX
lea edi, [ebp - 0x7c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.USER32.dll_GetSysColor]
push 0xf
call esi
mov ebx, eax
push 0x14
call esi
mov dword [ebp - 0x370], eax
push 0x15
call esi
mov esi, ebx
movzx ecx, bl
shr esi, 0x10
shl ecx, 0x10
mov edx, eax
and esi, 0xff
or esi, ecx
mov ecx, dword [ebp - 0x370]
and ebx, 0xff00
mov edi, ecx
movzx eax, cl
shr edi, 0x10
shl eax, 0x10
or esi, ebx
and edi, 0xff
or edi, eax
mov ebx, edx
shr ebx, 0x10
movzx eax, dl
and ebx, 0xff
shl eax, 0x10
or ebx, eax
mov eax, dword [ebp - 0x36c]
and ecx, 0xff00
and edx, 0xff00
or edi, ecx
or ebx, edx
xor ecx, ecx
lea ebx, [ebx]
mov dl, byte [ebp + ecx - 0x40]
cmp dl, 0x4f
je 0x57f08b
cmp dl, 0x58
je 0x57f087
cmp dl, 0x5f
jne 0x57f08d
mov eax, esi
jmp 0x57f08d
mov eax, edi
jmp 0x57f08d
mov eax, ebx
mov dl, byte [ebp + ecx - 0x7c]
mov dword [ebp + ecx*4 - 0x160], eax
cmp dl, 0x4f
je 0x57f0af
cmp dl, 0x58
je 0x57f0ab
cmp dl, 0x5f
jne 0x57f0b1
mov eax, esi
jmp 0x57f0b1
mov eax, edi
jmp 0x57f0b1
mov eax, ebx
mov dword [ebp + ecx*4 - 0x240], eax
inc ecx
cmp ecx, 0x38
jl 0x57f070
mov esi, dword [sym.imp.GDI32.dll_CreateBitmap]
lea eax, [ebp - 0x160]
push eax
push 0x20
push 1
push 7
push 8
call esi
mov ebx, dword [ebp - 0x36c]
push eax
lea ecx, [ebx + 0x738]
call fcn.00429d75
lea eax, [ebp - 0x240]
push eax
push 0x20
push 1
push 7
push 8
call esi
push eax
lea ecx, [ebx + 0x740]
call fcn.00429d75
lea ecx, [ebx + 0x748]
call fcn.00429e96
mov edi, dword [sym.imp.KERNEL32.dll_FindResourceW]
xor esi, esi
jmp 0x57f120
mov eax, dword [esi*4 + 0x65f690]
test eax, eax
je 0x57f14f
push 0x6158b0
push 0xaa
push eax
call edi
test eax, eax
jne 0x57f144
inc esi
cmp esi, 0xa
jl 0x57f120
jmp 0x57f14f
mov esi, dword [esi*4 + 0x65f690]
test esi, esi
jne 0x57f15f
call fcn.0042def3
mov esi, dword [eax + 0xc]
test esi, esi
jne 0x57f15f
xor eax, eax
jmp 0x57f179
push 0x6158c8
push 0xaa
push esi
call edi
test eax, eax
je 0x57f179
mov edx, eax
mov ecx, esi
call fcn.005b8cb0
push eax
lea ecx, [ebx + 0x748]
call fcn.00429d75
lea ecx, [ebx + 0x750]
call fcn.00429e96
xor esi, esi
mov eax, dword [esi*4 + 0x65f690]
test eax, eax
je 0x57f1c1
push 0x6158b0
push 0xab
push eax
call edi
test eax, eax
jne 0x57f1b6
inc esi
cmp esi, 0xa
jl 0x57f192
jmp 0x57f1c1
mov esi, dword [esi*4 + 0x65f690]
test esi, esi
jne 0x57f1d1
call fcn.0042def3
mov esi, dword [eax + 0xc]
test esi, esi
jne 0x57f1d1
xor eax, eax
jmp 0x57f1eb
push 0x6158c8
push 0xab
push esi
call edi
test eax, eax
je 0x57f1eb
mov edx, eax
mov ecx, esi
call fcn.005b8cb0
push eax
lea ecx, [ebx + 0x750]
call fcn.00429d75
lea eax, [ebp - 0x368]
push eax
mov dword [ebp - 0x368], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x364], 6
push 0
push 1
push 0
push 1
jb 0x57f223
push 0
jmp 0x57f22c
push 4
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
mov edx, dword [0x650ca4]
push 0xd7
push 0xd6
lea ecx, [ebx + 0x760]
call fcn.005b7770
add esp, 0x1c
mov dword [ebx + 0x758], eax
test eax, eax
je 0x57f260
push eax
call fcn.00429fd0
mov dword [ebx + 0x75c], eax
mov edx, dword [0x650ca4]
push 0
push 1
push 0
push 9
push 0xf7f7f7
push 0xbb
push 0xba
lea ecx, [ebx + 0x2c0]
call fcn.005b7770
add esp, 0x1c
mov dword [ebx + 0x2b8], eax
mov edx, dword [0x650ca4]
push 0
push 1
push 0
push 9
push 0xffe7e7
push 0xbb
lea ecx, [ebx + 0x2c4]
push 0xba
call fcn.005b7770
add esp, 0x1c
mov dword [ebx + 0x2bc], eax
lea eax, [ebp - 0x388]
push eax
push 0x18
push dword [ebx + 0x2b8]
lea esi, [ebx + 0x2c8]
call dword [sym.imp.GDI32.dll_GetObjectW]
mov eax, dword [ebp - 0x384]
mov dword [esi], eax
mov eax, dword [ebp - 0x380]
mov dword [esi + 4], eax
cmp dword [ebx + 0x2b8], 0
je 0x57f321
mov edx, dword [0x650ca4]
push esi
push 0
push 0x63
push 1
push 0xd7e0f5
push 0x13f
push 0xba
lea ecx, [ebx + 0x2c0]
call fcn.005b7770
add esp, 0x1c
cmp dword [ebx + 0x2bc], 0
je 0x57f354
mov edx, dword [0x650ca4]
push esi
push 0
push 0x63
push 1
push 0xffe7e7
push 0x13f
push 0xba
lea ecx, [ebx + 0x2c4]
call fcn.005b7770
add esp, 0x1c
mov eax, 0x66666667
imul dword [esi]
sar edx, 2
mov eax, edx
sub esp, 8
shr eax, 0x1f
add eax, edx
push 0x190
push 0xe
lea ecx, [ebx + 0x764]
mov dword [esi], eax
call fcn.005940a0
add esp, 8
lea ecx, [ebx + 0x768]
push 0x2bc
push 0xe
call fcn.005940a0
mov eax, dword [ebx + 0x764]
add esp, 0x10
test eax, eax
je 0x57f3a1
mov eax, dword [eax + 4]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push eax
push 0x30
push dword [ebx + 0x20]
call edi
mov dword [ebx + 0x21c], 0
mov dword [ebx + 0x220], 0x27607
mov dword [ebx + 0x224], 0x28624
mov dword [ebx + 0x228], 0x29b55
mov dword [ebx + 0x22c], 0x2a896
mov dword [ebx + 0x230], 0x7cc2
mov dword [ebx + 0x234], 0x1543e3
mov dword [ebx + 0x238], 0xa24d5
mov dword [ebx + 0x23c], 0x204ac
mov dword [ebx + 0x240], 0x50f8d
mov eax, dword [ebx + 0x220]
xor eax, 0xffffff
mov dword [ebx + 0x248], eax
mov eax, dword [ebx + 0x224]
xor eax, 0xffffff
mov dword [ebx + 0x24c], eax
mov eax, dword [ebx + 0x228]
xor eax, 0xffffff
mov dword [ebx + 0x250], eax
mov eax, dword [ebx + 0x22c]
xor eax, 0xffffff
mov dword [ebx + 0x254], eax
mov eax, dword [ebx + 0x230]
xor eax, 0xffffff
mov dword [ebx + 0x258], eax
mov eax, dword [ebx + 0x234]
xor eax, 0xffffff
mov dword [ebx + 0x25c], eax
mov eax, dword [ebx + 0x238]
xor eax, 0xffffff
mov dword [ebx + 0x260], eax
mov eax, dword [ebx + 0x23c]
xor eax, 0xffffff
mov dword [ebx + 0x264], eax
mov eax, dword [ebx + 0x240]
push 0xf7f7f7
push 0
xor eax, 0xffffff
push 0x1001
mov dword [ebx + 0x244], 0xffffff
mov dword [ebx + 0x268], eax
push dword [ebx + 0x20]
call edi
mov esi, dword [sym.imp.GDI32.dll_CreatePen]
push 0xd5d5d5
push 1
push 0
call esi
push eax
lea ecx, [ebx + 0x774]
call fcn.00429d75
push 0xd9d9d9
push 1
push 0
call esi
push eax
lea ecx, [ebx + 0x77c]
call fcn.00429d75
push 0x20
push 0
push 0x1036
push dword [ebx + 0x20]
mov dword [ebx + 0x2ac], 0
call edi
mov eax, dword [0x650d18]
mov dword [ebx + 0x1f4], eax
mov eax, dword [0x65bd90]
mov dword [ebx + 0x1f8], eax
mov eax, dword [0x65bd94]
mov dword [ebx + 0x1fc], eax
mov eax, dword [0x65bd98]
mov dword [ebx + 0x200], eax
mov eax, dword [0x65bd9c]
mov dword [ebx + 0x204], eax
mov eax, dword [0x65bda0]
mov dword [ebx + 0x208], eax
mov eax, dword [0x65bda4]
mov dword [ebx + 0x20c], eax
mov eax, dword [0x65bda8]
mov dword [ebx + 0x210], eax
mov eax, dword [0x65bdac]
mov dword [ebx + 0x214], eax
mov eax, dword [0x65bdb0]
mov dword [ebx + 0x218], eax
mov eax, dword [0x65bdd8]
mov dword [ebx + 0x26c], eax
mov eax, dword [0x65bddc]
mov dword [ebx + 0x270], eax
mov eax, dword [0x65bde0]
mov dword [ebx + 0x274], eax
mov dword [ebx + 0x278], str.Extra2
mov eax, dword [0x65bde4]
mov dword [ebx + 0x27c], eax
mov dword [ebx + 0x288], str.ThreatSense
mov eax, dword [0x65bde8]
mov dword [ebx + 0x280], eax
mov eax, dword [0x65bdec]
mov ecx, ebx
mov dword [ebx + 0x284], eax
call fcn.0057e2e0
fld dword [0x650d1c]
fldz
fucom st(1)
fnstsw ax
test ah, 0x44
jp 0x57f5fa
fstp st(1)
mov eax, 0x80
jmp 0x57f607
fxch st(1)
fmul qword [0x622708]
call fcn.00549020
mov dword [ebx + 0xf4], eax
fld dword [0x650d1c]
fucom st(1)
fnstsw ax
fld qword [0x6226f8]
test ah, 0x44
jp 0x57f62b
fstp st(1)
mov eax, 0x64
jmp 0x57f634
fmul st(1), st(0)
fxch st(1)
call fcn.00549020
mov dword [ebx + 0x104], eax
fld dword [0x650d1c]
fucom st(2)
fnstsw ax
test ah, 0x44
jp 0x57f652
fstp st(0)
mov eax, 0xc8
jmp 0x57f65d
fmul qword [0x622718]
call fcn.00549020
mov dword [ebx + 0x110], eax
fld dword [0x650d1c]
fucom st(2)
fnstsw ax
test ah, 0x44
jp 0x57f67b
fstp st(0)
mov eax, 0x64
jmp 0x57f682
fmul st(1)
call fcn.00549020
mov dword [ebx + 0xfc], eax
fld dword [0x650d1c]
fucom st(2)
fnstsw ax
fstp st(2)
test ah, 0x44
jp 0x57f6a4
fstp st(1)
mov eax, 0x64
fstp st(0)
jmp 0x57f6ab
fmulp st(1)
call fcn.00549020
mov dword [ebx + 0x100], eax
lea eax, [ebp - 0x250]
push eax
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov esi, dword [ebp - 0x248]
sub esi, dword [ebx + 0x104]
mov eax, 0x51eb851f
sub esi, dword [ebx + 0xf4]
push 0
sub esi, dword [ebp - 0x250]
push 0x60e57c
sub esi, 0x10
mov ecx, esi
imul ecx, ecx, 0x46
mul ecx
mov ecx, esi
imul ecx, ecx, 0x32
shr edx, 5
mov dword [ebx + 0xf8], edx
mov eax, 0x51eb851f
mul ecx
shr edx, 5
mov dword [ebx + 0x108], edx
lea ecx, [esi + esi*4]
shl ecx, 2
mov eax, 0x51eb851f
mul ecx
shr edx, 5
mov dword [ebx + 0x10c], edx
lea esi, [ebx + 0x76c]
push 0x5f
mov ecx, esi
mov dword [ebx + 0xe0], 0
mov dword [ebx + 0xdc], 0
call fcn.0042d48e
test esi, esi
jne 0x57f74e
xor eax, eax
jmp 0x57f751
mov eax, dword [esi + 4]
push 1
push eax
push 0x30
push dword [ebx + 0x20]
call edi
mov eax, dword [ebx + 0x764]
mov ecx, dword [ebx + 0x74]
test eax, eax
je 0x57f76b
mov eax, dword [eax + 4]
push 1
push eax
push 0x30
push dword [ecx + 0x20]
call edi
mov dword [ebx + 0x72c], 0
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
mov dword [ebx + 0x81c], eax
cmp eax, 0x3e8
jbe 0x57f79c
mov dword [ebx + 0x81c], 0x3e8
push 1
mov ecx, ebx
mov dword [ebx + 0x98], 0
mov dword [ebx + 0x8c], 0
mov dword [ebx + 0x80], 0
mov dword [ebx + 0x720], 0xffffffff
mov dword [ebx + 0x724], 0
call fcn.0042e243
mov eax, dword [ebx + 0x788]
lea esi, [ebx + 0x788]
push 1
push ebx
mov ecx, esi
call dword [eax + 0x160]
push 0
push 1
push 0x401
push dword [ebx + 0x7a8]
call edi
push 0x12c
push 0
push 0x418
push dword [ebx + 0x7a8]
call edi
push 0x2710
push 2
push 0x403
push dword [ebx + 0x7a8]
call edi
push 0x32
push 3
push 0x403
push dword [ebx + 0x7a8]
call edi
push 0x32
push 1
push 0x403
push dword [ebx + 0x7a8]
call edi
test esi, esi
jne 0x57f851
xor eax, eax
jmp 0x57f854
mov eax, dword [esi + 0x20]
push eax
push 0
push 0x104a
push dword [ebx + 0x20]
call edi
push eax
call fcn.00423869
mov ecx, dword [ebp - 4]
mov dword [ebx + 0x818], 0
pop edi
mov dword [ebx + 0xb4], str.HKLM_
mov dword [ebx + 0xb8], str.HKEY_LOCAL_MACHINE_
mov dword [ebx + 0xbc], str.HKCU_
mov dword [ebx + 0xc0], str.HKEY_CURRENT_USER_
mov dword [ebx + 0xc4], str.HKCR_
mov dword [ebx + 0xc8], str.HKEY_CLASSES_ROOT_
mov dword [ebx + 0xcc], str.HKCC_
mov dword [ebx + 0xd0], str.HKEY_CURRENT_CONFIG_
mov dword [ebx + 0xd4], str.HKUR_
mov dword [ebx + 0xd8], str.HKEY_USERS_
pop esi
mov dword [ebx + 0x820], 1
mov dword [ebx + 0x824], 0
xor ecx, ebp
pop ebx
call fcn.00541b41
mov esp, ebp
pop ebp
ret