Function at 0x486450
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4b8660
push 0x40d810
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x1718
call fcn.004175a0
mov eax, dword [0x4bc534]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x3c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 0
jmp 0x4864ad
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x31
jge 0x4864f1
mov eax, dword [ebp - 0x1c]
cdq
sub eax, edx
sar eax, 1
and eax, 0x80000001
jns 0x4864c7
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x4864d7
mov ecx, dword [ebp - 0x1c]
and ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ecx
jmp 0x4864ef
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4864ef
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x4864a4
mov dword [ebp - 4], 0xfffffffe
call fcn.004864ff
jmp 0x48650e
mov dword [ebp - 0x24], 0
jmp 0x486520
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 0x2e
jge 0x486533
mov edx, dword [ebp - 0x24]
not edx
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x486517
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x486547
mov eax, dword [ebp - 0x1c]
neg eax
imul eax, eax, 0xfffffffd
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x48655d
mov dword [ebp - 0x1c], 0xb
mov dword [ebp - 0x28], 0
jmp 0x48656f
mov edx, dword [ebp - 0x28]
add edx, 1
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], 0xb
jge 0x486582
mov eax, dword [ebp - 0x28]
not eax
xor eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x486566
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x486596
mov ecx, dword [ebp - 0x1c]
neg ecx
imul ecx, ecx, 0xfffffffd
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4865ac
mov dword [ebp - 0x1c], 0xb
mov dword [ebp - 4], 1
mov dword [ebp - 0x2c], 0
jmp 0x4865c5
mov edx, dword [ebp - 0x2c]
add edx, 1
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], 0xb
jge 0x4865f5
mov eax, dword [ebp - 0x2c]
and eax, 0x80000001
jns 0x4865da
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x4865ea
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4865f3
mov edx, dword [ebp - 0x1c]
sub edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x4865bc
mov dword [ebp - 4], 0xfffffffe
call fcn.00486603
jmp 0x486620
mov dword [ebp - 4], 2
mov dword [ebp - 0x30], 0
jmp 0x486639
mov edx, dword [ebp - 0x30]
add edx, 1
mov dword [ebp - 0x30], edx
cmp dword [ebp - 0x30], 0x1d
jge 0x486669
mov eax, dword [ebp - 0x30]
and eax, 0x80000001
jns 0x48664e
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x48665e
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x486667
mov edx, dword [ebp - 0x1c]
sub edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x486630
mov dword [ebp - 4], 0xfffffffe
call fcn.00486677
jmp 0x486694
mov dword [ebp - 4], 3
mov dword [ebp - 0x34], 0
jmp 0x4866ad
mov edx, dword [ebp - 0x34]
add edx, 1
mov dword [ebp - 0x34], edx
cmp dword [ebp - 0x34], 7
jge 0x4866dd
mov eax, dword [ebp - 0x34]
and eax, 0x80000001
jns 0x4866c2
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x4866d2
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4866db
mov edx, dword [ebp - 0x1c]
sub edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x4866a4
mov dword [ebp - 4], 0xfffffffe
call fcn.004866eb
jmp 0x486708
mov dword [ebp - 0x38], 0
jmp 0x48671a
mov edx, dword [ebp - 0x38]
add edx, 1
mov dword [ebp - 0x38], edx
cmp dword [ebp - 0x38], 0xa
jge 0x486758
cmp dword [ebp - 0x1c], 0
jge 0x48672e
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x486744
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x238]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x486711
mov dword [ebp - 4], 4
mov dword [ebp - 0x23c], 0
jmp 0x48677a
mov eax, dword [ebp - 0x23c]
add eax, 1
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
jge 0x4867b9
mov eax, dword [ebp - 0x23c]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x4867a9
mov eax, dword [ebp - 0x23c]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x4867b4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1c], eax
jmp 0x4867b7
mov dword [ebp - 0x1c], eax
jmp 0x48676b
mov dword [ebp - 4], 0xfffffffe
call fcn.004867c7
jmp 0x4867cf
mov dword [ebp - 4], 5
mov dword [ebp - 0x240], 0
jmp 0x4867f1
mov edx, dword [ebp - 0x240]
add edx, 1
mov dword [ebp - 0x240], edx
cmp dword [ebp - 0x240], 0
jge 0x48682c
mov eax, dword [ebp - 0x240]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x486820
mov eax, dword [ebp - 0x240]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x486827
and eax, 0xbc614e
jmp 0x48682a
mov dword [ebp - 0x1c], eax
jmp 0x4867e2
mov dword [ebp - 4], 0xfffffffe
call fcn.0048683a
jmp 0x486842
mov dword [ebp - 0x244], 0
jmp 0x48685d
mov edx, dword [ebp - 0x244]
add edx, 1
mov dword [ebp - 0x244], edx
cmp dword [ebp - 0x244], 0xd
jge 0x48689e
cmp dword [ebp - 0x1c], 0
jge 0x486874
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x48688a
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x440]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x48684e
mov dword [ebp - 0x444], 1
mov dword [ebp - 0x448], 1
mov dword [ebp - 0x44c], 2
mov dword [ebp - 0x450], 0
mov dword [ebp - 0x454], 0
jmp 0x4868e1
mov eax, dword [ebp - 0x454]
add eax, 1
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 5
jge 0x486922
mov ecx, dword [ebp - 0x444]
add ecx, dword [ebp - 0x448]
mov dword [ebp - 0x44c], ecx
mov edx, dword [ebp - 0x448]
mov dword [ebp - 0x444], edx
mov eax, dword [ebp - 0x44c]
mov dword [ebp - 0x448], eax
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x44c]
mov dword [ebp - 0x1c], ecx
jmp 0x4868d2
mov edx, dword [ebp - 0x1c]
add edx, 5
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], 6
mov dword [ebp - 0x458], 0
jmp 0x48694d
mov eax, dword [ebp - 0x458]
add eax, 1
mov dword [ebp - 0x458], eax
cmp dword [ebp - 0x458], 6
jge 0x486994
mov eax, dword [ebp - 0x1c]
cdq
sub eax, edx
sar eax, 1
and eax, 0x80000001
jns 0x48696a
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x48697a
mov ecx, dword [ebp - 0x1c]
and ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ecx
jmp 0x486992
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x486992
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x48693e
mov dword [ebp - 4], 0xfffffffe
call fcn.004869a2
jmp 0x4869b1
mov dword [ebp - 4], 7
mov dword [ebp - 0x45c], 0
jmp 0x4869d3
mov ecx, dword [ebp - 0x45c]
add ecx, 1
mov dword [ebp - 0x45c], ecx
cmp dword [ebp - 0x45c], 1
jge 0x486a1a
mov eax, dword [ebp - 0x1c]
cdq
sub eax, edx
sar eax, 1
and eax, 0x80000001
jns 0x4869f0
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x486a00
mov edx, dword [ebp - 0x1c]
and edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x486a18
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x486a18
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x4869c4
mov dword [ebp - 4], 0xfffffffe
call fcn.00486a28
jmp 0x486a37
mov dword [ebp - 0x460], 0
jmp 0x486a52
mov ecx, dword [ebp - 0x460]
add ecx, 1
mov dword [ebp - 0x460], ecx
cmp dword [ebp - 0x460], 4
jge 0x486a6b
mov edx, dword [ebp - 0x460]
not edx
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x486a43
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x486a7f
mov eax, dword [ebp - 0x1c]
neg eax
imul eax, eax, 0xfffffffd
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x486a95
mov dword [ebp - 0x1c], 0xb
mov dword [ebp - 0x464], 0
jmp 0x486ab0
mov edx, dword [ebp - 0x464]
add edx, 1
mov dword [ebp - 0x464], edx
cmp dword [ebp - 0x464], 2
jge 0x486af1
cmp dword [ebp - 0x1c], 0
jge 0x486ac7
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x486add
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x660]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x486aa1
mov dword [ebp - 0x664], 0
jmp 0x486b0c
mov eax, dword [ebp - 0x664]
add eax, 1
mov dword [ebp - 0x664], eax
cmp dword [ebp - 0x664], 0
jge 0x486b25
mov ecx, dword [ebp - 0x664]
not ecx
xor ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ecx
jmp 0x486afd
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x486b39
mov edx, dword [ebp - 0x1c]
neg edx
imul edx, edx, 0xfffffffd
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x486b4f
mov dword [ebp - 0x1c], 0xb
mov dword [ebp - 0x668], 0
jmp 0x486b6a
mov edx, dword [ebp - 0x668]
add edx, 1
mov dword [ebp - 0x668], edx
cmp dword [ebp - 0x668], 1
jge 0x486b83
mov eax, dword [ebp - 0x668]
not eax
xor eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x486b5b
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x486b97
mov ecx, dword [ebp - 0x1c]
neg ecx
imul ecx, ecx, 0xfffffffd
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x486bad
mov dword [ebp - 0x1c], 0xb
mov dword [ebp - 4], 8
mov dword [ebp - 0x66c], 0
jmp 0x486bcf
mov edx, dword [ebp - 0x66c]
add edx, 1
mov dword [ebp - 0x66c], edx
cmp dword [ebp - 0x66c], 1
jge 0x486c05
mov eax, dword [ebp - 0x66c]
and eax, 0x80000001
jns 0x486bea
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x486bfa
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x486c03
mov edx, dword [ebp - 0x1c]
sub edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x486bc0
mov dword [ebp - 4], 0xfffffffe
call fcn.00486c13
jmp 0x486c30
mov dword [ebp - 0x670], 0
jmp 0x486c4b
mov edx, dword [ebp - 0x670]
add edx, 1
mov dword [ebp - 0x670], edx
cmp dword [ebp - 0x670], 2
jge 0x486c8c
cmp dword [ebp - 0x1c], 0
jge 0x486c62
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x486c78
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x868]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x486c3c
mov dword [ebp - 0x86c], 0
jmp 0x486ca7
mov eax, dword [ebp - 0x86c]
add eax, 1
mov dword [ebp - 0x86c], eax
cmp dword [ebp - 0x86c], 0
jge 0x486ce8
cmp dword [ebp - 0x1c], 0
jge 0x486cbe
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x486cd4
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0xa68]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x486c98
mov dword [ebp - 4], 9
mov dword [ebp - 0xa6c], 0
jmp 0x486d0a
mov eax, dword [ebp - 0xa6c]
add eax, 1
mov dword [ebp - 0xa6c], eax
cmp dword [ebp - 0xa6c], 0
jge 0x486d49
mov eax, dword [ebp - 0xa6c]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x486d39
mov eax, dword [ebp - 0xa6c]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x486d44
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1c], eax
jmp 0x486d47
mov dword [ebp - 0x1c], eax
jmp 0x486cfb
mov dword [ebp - 4], 0xfffffffe
call fcn.00486d57
jmp 0x486d5f
mov dword [ebp - 0xa70], 0
jmp 0x486d7a
mov edx, dword [ebp - 0xa70]
add edx, 1
mov dword [ebp - 0xa70], edx
cmp dword [ebp - 0xa70], 3
jge 0x486d93
mov eax, dword [ebp - 0xa70]
not eax
xor eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x486d6b
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x486da7
mov ecx, dword [ebp - 0x1c]
neg ecx
imul ecx, ecx, 0xfffffffd
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x486dbd
mov dword [ebp - 0x1c], 0xb
mov dword [ebp - 4], 0xa
mov dword [ebp - 0xa74], 0
jmp 0x486ddf
mov edx, dword [ebp - 0xa74]
add edx, 1
mov dword [ebp - 0xa74], edx
cmp dword [ebp - 0xa74], 3
jge 0x486e26
mov eax, dword [ebp - 0x1c]
cdq
sub eax, edx
sar eax, 1
and eax, 0x80000001
jns 0x486dfc
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x486e0c
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x486e24
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x486e24
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x486dd0
mov dword [ebp - 4], 0xfffffffe
call fcn.00486e34
jmp 0x486e43
mov dword [ebp - 4], 0xb
mov dword [ebp - 0xa78], 0
jmp 0x486e65
mov ecx, dword [ebp - 0xa78]
add ecx, 1
mov dword [ebp - 0xa78], ecx
cmp dword [ebp - 0xa78], 4
jge 0x486e9c
mov edx, dword [ebp - 0xa78]
and edx, 0x80000001
jns 0x486e81
dec edx
or edx, 0xfffffffe
inc edx
cmp edx, 1
jne 0x486e91
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
jmp 0x486e9a
mov ecx, dword [ebp - 0x1c]
sub ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x486e56
mov dword [ebp - 4], 0xfffffffe
call fcn.00486eaa
jmp 0x486ec8
mov dword [ebp - 4], 0xc
mov dword [ebp - 0xa7c], 0
jmp 0x486eea
mov ecx, dword [ebp - 0xa7c]
add ecx, 1
mov dword [ebp - 0xa7c], ecx
cmp dword [ebp - 0xa7c], 1
jge 0x486f21
mov edx, dword [ebp - 0xa7c]
and edx, 0x80000001
jns 0x486f06
dec edx
or edx, 0xfffffffe
inc edx
cmp edx, 1
jne 0x486f16
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
jmp 0x486f1f
mov ecx, dword [ebp - 0x1c]
sub ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x486edb
mov dword [ebp - 4], 0xfffffffe
call fcn.00486f2f
jmp 0x486f4d
mov dword [ebp - 0xa80], 0
jmp 0x486f68
mov ecx, dword [ebp - 0xa80]
add ecx, 1
mov dword [ebp - 0xa80], ecx
cmp dword [ebp - 0xa80], 3
jge 0x486fa9
cmp dword [ebp - 0x1c], 0
jge 0x486f7f
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x486f95
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0xc78]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x486f59
mov dword [ebp - 4], 0xd
mov dword [ebp - 0xc7c], 0
jmp 0x486fcb
mov eax, dword [ebp - 0xc7c]
add eax, 1
mov dword [ebp - 0xc7c], eax
cmp dword [ebp - 0xc7c], 2
jge 0x487006
mov eax, dword [ebp - 0xc7c]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x486ffa
mov eax, dword [ebp - 0xc7c]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x487001
and eax, 0xbc614e
jmp 0x487004
mov dword [ebp - 0x1c], eax
jmp 0x486fbc
mov dword [ebp - 4], 0xfffffffe
call fcn.00487014
jmp 0x48701c
mov dword [ebp - 0xc80], 1
mov dword [ebp - 0xc84], 1
mov dword [ebp - 0xc88], 2
mov dword [ebp - 0xc8c], 0
mov dword [ebp - 0xc90], 0
jmp 0x48705f
mov edx, dword [ebp - 0xc90]
add edx, 1
mov dword [ebp - 0xc90], edx
cmp dword [ebp - 0xc90], 2
jge 0x4870a0
mov eax, dword [ebp - 0xc80]
add eax, dword [ebp - 0xc84]
mov dword [ebp - 0xc88], eax
mov ecx, dword [ebp - 0xc84]
mov dword [ebp - 0xc80], ecx
mov edx, dword [ebp - 0xc88]
mov dword [ebp - 0xc84], edx
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0xc88]
mov dword [ebp - 0x1c], eax
jmp 0x487050
mov ecx, dword [ebp - 0x1c]
add ecx, 2
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0xc94], 0
jmp 0x4870c4
mov edx, dword [ebp - 0xc94]
add edx, 1
mov dword [ebp - 0xc94], edx
cmp dword [ebp - 0xc94], 1
jge 0x4870dd
mov eax, dword [ebp - 0xc94]
not eax
xor eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x4870b5
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4870f1
mov ecx, dword [ebp - 0x1c]
neg ecx
imul ecx, ecx, 0xfffffffd
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x487107
mov dword [ebp - 0x1c], 0xb
mov dword [ebp - 0xc98], 0
jmp 0x487122
mov edx, dword [ebp - 0xc98]
add edx, 1
mov dword [ebp - 0xc98], edx
cmp dword [ebp - 0xc98], 2
jge 0x487163
cmp dword [ebp - 0x1c], 0
jge 0x487139
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x48714f
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0xe90]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x487113
mov dword [ebp - 0xe94], 1
mov dword [ebp - 0xe98], 1
mov dword [ebp - 0xe9c], 2
mov dword [ebp - 0xea0], 0
mov dword [ebp - 0xea4], 0
jmp 0x4871a6
mov eax, dword [ebp - 0xea4]
add eax, 1
mov dword [ebp - 0xea4], eax
cmp dword [ebp - 0xea4], 4
jge 0x4871e7
mov ecx, dword [ebp - 0xe94]
add ecx, dword [ebp - 0xe98]
mov dword [ebp - 0xe9c], ecx
mov edx, dword [ebp - 0xe98]
mov dword [ebp - 0xe94], edx
mov eax, dword [ebp - 0xe9c]
mov dword [ebp - 0xe98], eax
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0xe9c]
mov dword [ebp - 0x1c], ecx
jmp 0x487197
mov edx, dword [ebp - 0x1c]
add edx, 4
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], 0xe
mov dword [ebp - 0xea8], 0
jmp 0x487212
mov eax, dword [ebp - 0xea8]
add eax, 1
mov dword [ebp - 0xea8], eax
cmp dword [ebp - 0xea8], 1
jge 0x487259
mov eax, dword [ebp - 0x1c]
cdq
sub eax, edx
sar eax, 1
and eax, 0x80000001
jns 0x48722f
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x48723f
mov ecx, dword [ebp - 0x1c]
and ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ecx
jmp 0x487257
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x487257
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x487203
mov dword [ebp - 4], 0xfffffffe
call fcn.00487267
jmp 0x487276
mov dword [ebp - 0xeac], 0
jmp 0x487291
mov ecx, dword [ebp - 0xeac]
add ecx, 1
mov dword [ebp - 0xeac], ecx
cmp dword [ebp - 0xeac], 1
jge 0x4872d2
cmp dword [ebp - 0x1c], 0
jge 0x4872a8
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4872be
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x10a8]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x487282
mov dword [ebp - 0x10ac], 1
mov dword [ebp - 0x10b0], 1
mov dword [ebp - 0x10b4], 2
mov dword [ebp - 0x10b8], 0
mov dword [ebp - 0x10bc], 0
jmp 0x487315
mov eax, dword [ebp - 0x10bc]
add eax, 1
mov dword [ebp - 0x10bc], eax
cmp dword [ebp - 0x10bc], 3
jge 0x487356
mov ecx, dword [ebp - 0x10ac]
add ecx, dword [ebp - 0x10b0]
mov dword [ebp - 0x10b4], ecx
mov edx, dword [ebp - 0x10b0]
mov dword [ebp - 0x10ac], edx
mov eax, dword [ebp - 0x10b4]
mov dword [ebp - 0x10b0], eax
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x10b4]
mov dword [ebp - 0x1c], ecx
jmp 0x487306
mov edx, dword [ebp - 0x1c]
add edx, 3
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x10c0], 0
jmp 0x48737a
mov eax, dword [ebp - 0x10c0]
add eax, 1
mov dword [ebp - 0x10c0], eax
cmp dword [ebp - 0x10c0], 4
jge 0x4873bb
cmp dword [ebp - 0x1c], 0
jge 0x487391
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4873a7
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x12b8]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x48736b
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x12bc], 0
jmp 0x4873dd
mov eax, dword [ebp - 0x12bc]
add eax, 1
mov dword [ebp - 0x12bc], eax
cmp dword [ebp - 0x12bc], 1
jge 0x487418
mov eax, dword [ebp - 0x12bc]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x48740c
mov eax, dword [ebp - 0x12bc]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x487413
and eax, 0xbc614e
jmp 0x487416
mov dword [ebp - 0x1c], eax
jmp 0x4873ce
mov dword [ebp - 4], 0xfffffffe
call fcn.00487426
jmp 0x48742e
mov dword [ebp - 0x12c0], 0
jmp 0x487449
mov edx, dword [ebp - 0x12c0]
add edx, 1
mov dword [ebp - 0x12c0], edx
cmp dword [ebp - 0x12c0], 0
jge 0x487462
mov eax, dword [ebp - 0x12c0]
not eax
xor eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x48743a
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x487476
mov ecx, dword [ebp - 0x1c]
neg ecx
imul ecx, ecx, 0xfffffffd
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x48748c
mov dword [ebp - 0x1c], 0xb
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x12c4], 0
jmp 0x4874ae
mov edx, dword [ebp - 0x12c4]
add edx, 1
mov dword [ebp - 0x12c4], edx
cmp dword [ebp - 0x12c4], 4
jge 0x4874e4
mov eax, dword [ebp - 0x12c4]
and eax, 0x80000001
jns 0x4874c9
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x4874d9
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4874e2
mov edx, dword [ebp - 0x1c]
sub edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x48749f
mov dword [ebp - 4], 0xfffffffe
call fcn.004874f2
jmp 0x48750f
mov dword [ebp - 0x12c8], 0
jmp 0x48752a
mov edx, dword [ebp - 0x12c8]
add edx, 1
mov dword [ebp - 0x12c8], edx
cmp dword [ebp - 0x12c8], 1
jge 0x487543
mov eax, dword [ebp - 0x12c8]
not eax
xor eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x48751b
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x487557
mov ecx, dword [ebp - 0x1c]
neg ecx
imul ecx, ecx, 0xfffffffd
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x48756d
mov dword [ebp - 0x1c], 0xb
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x12cc], 0
jmp 0x48758f
mov edx, dword [ebp - 0x12cc]
add edx, 1
mov dword [ebp - 0x12cc], edx
cmp dword [ebp - 0x12cc], 0
jge 0x4875c5
mov eax, dword [ebp - 0x12cc]
and eax, 0x80000001
jns 0x4875aa
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x4875ba
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4875c3
mov edx, dword [ebp - 0x1c]
sub edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x487580
mov dword [ebp - 4], 0xfffffffe
call fcn.004875d3
jmp 0x4875f0
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x12d0], 0
jmp 0x487612
mov edx, dword [ebp - 0x12d0]
add edx, 1
mov dword [ebp - 0x12d0], edx
cmp dword [ebp - 0x12d0], 3
jge 0x487659
mov eax, dword [ebp - 0x1c]
cdq
sub eax, edx
sar eax, 1
and eax, 0x80000001
jns 0x48762f
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x48763f
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x487657
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x487657
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x487603
mov dword [ebp - 4], 0xfffffffe
call fcn.00487667
jmp 0x487676
mov dword [ebp - 0x12d4], 0
jmp 0x487691
mov ecx, dword [ebp - 0x12d4]
add ecx, 1
mov dword [ebp - 0x12d4], ecx
cmp dword [ebp - 0x12d4], 2
jge 0x4876d2
cmp dword [ebp - 0x1c], 0
jge 0x4876a8
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4876be
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x14d0]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x487682
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x14d4], 0
jmp 0x4876f4
mov eax, dword [ebp - 0x14d4]
add eax, 1
mov dword [ebp - 0x14d4], eax
cmp dword [ebp - 0x14d4], 0
jge 0x487733
mov eax, dword [ebp - 0x14d4]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x487723
mov eax, dword [ebp - 0x14d4]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x48772e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1c], eax
jmp 0x487731
mov dword [ebp - 0x1c], eax
jmp 0x4876e5
mov dword [ebp - 4], 0xfffffffe
call fcn.00487741
jmp 0x487749
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x14d8], 0
jmp 0x48776b
cmp dword [ebp - 0x14d8], 0
jge 0x4877b2
mov eax, dword [ebp - 0x1c]
cdq
sub eax, edx
sar eax, 1
and eax, 0x80000001
jns 0x487788
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x487798
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x4877b0
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4877b0
mov dword [ebp - 4], 0xfffffffe
call fcn.004877c0
jmp 0x4877cf
mov dword [ebp - 0x14dc], 1
mov dword [ebp - 0x14e0], 1
mov dword [ebp - 0x14e4], 2
mov dword [ebp - 0x14e8], 0
mov dword [ebp - 0x14ec], 0
jmp 0x487812
cmp dword [ebp - 0x14ec], 1
jge 0x487853