Function at 0x10003cd8
Capabilities:
Check os version
Encode data using xor
Get common file path

Disassembly:
push 0x22c
push 0x100c1b58
call fcn.10075ce0
and dword [ebp - 0x214], 0
xor eax, eax
mov ecx, eax
and ecx, reloc.WS2_32.dll_accept
jns 0x10003cff
dec ecx
or ecx, 0xfffffffe
inc ecx
cmp ecx, 1
jne 0x10003d0c
add dword [ebp - 0x214], eax
jmp 0x10003d12
sub dword [ebp - 0x214], eax
inc eax
cmp eax, 0x20
jl 0x10003cf0
mov esi, 0x100a6ea4
push esi
push esi
mov edi, dword [sym.imp.USER32.dll_FindWindowW]
call edi
xor ecx, ecx
mov eax, ecx
cdq
push 5
pop ebx
idiv ebx
cmp edx, 1
je 0x10003d43
cmp edx, 4
je 0x10003d43
and dword [ebp - 0x214], ecx
jmp 0x10003d49
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 0x13
jl 0x10003d29
push 0xfa
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
mov ecx, eax
and ecx, reloc.WS2_32.dll_accept
jns 0x10003d72
dec ecx
or ecx, 0xfffffffe
inc ecx
cmp ecx, 1
jne 0x10003d7f
add dword [ebp - 0x214], eax
jmp 0x10003d85
sub dword [ebp - 0x214], eax
inc eax
cmp eax, 0x17
jl 0x10003d63
push esi
push esi
call edi
xor eax, eax
mov ecx, eax
and ecx, reloc.WS2_32.dll_accept
jns 0x10003da0
dec ecx
or ecx, 0xfffffffe
inc ecx
cmp ecx, 1
jne 0x10003dad
add dword [ebp - 0x214], eax
jmp 0x10003db3
sub dword [ebp - 0x214], eax
inc eax
cmp eax, 0x11
jl 0x10003d91
push esi
push esi
call edi
xor eax, eax
sub dword [ebp - 0x214], eax
inc eax
cmp eax, 4
jl 0x10003dbf
mov ebx, 0xffff0001
mov eax, dword [ebp - 0x214]
cmp eax, ebx
jge 0x10003de3
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
cdq
push 7
pop ecx
idiv ecx
test edx, edx
je 0x10003df9
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x214], eax
xor eax, eax
sub dword [ebp - 0x214], eax
inc eax
cmp eax, 4
jl 0x10003dfb
cmp dword [ebp - 0x214], ebx
jge 0x10003e1e
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
je 0x10003e3a
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x214], eax
xor ecx, ecx
mov eax, ecx
cdq
push 5
pop ebx
idiv ebx
cmp edx, 1
je 0x10003e56
cmp edx, 4
je 0x10003e56
and dword [ebp - 0x214], ecx
jmp 0x10003e5c
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 3
jl 0x10003e3c
push 0xfa
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor ebx, ebx
xor eax, eax
and dword [ebp - 0x214], eax
inc eax
cmp eax, 4
jl 0x10003e78
cmp dword [ebp - 0x214], ebx
jge 0x10003e9b
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 0xd
pop ecx
idiv ecx
test edx, edx
jne 0x10003eb7
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x214], eax
xor eax, eax
and dword [ebp - 0x214], eax
inc eax
cmp eax, 3
jl 0x10003eb9
cmp dword [ebp - 0x214], ebx
jge 0x10003edc
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 0xd
pop ecx
idiv ecx
test edx, edx
jne 0x10003ef8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x214], eax
xor eax, eax
mov ecx, eax
and ecx, reloc.WS2_32.dll_accept
jns 0x10003f09
dec ecx
or ecx, 0xfffffffe
inc ecx
cmp ecx, 1
jne 0x10003f16
add dword [ebp - 0x214], eax
jmp 0x10003f1c
sub dword [ebp - 0x214], eax
inc eax
cmp eax, 2
jl 0x10003efa
push esi
push esi
call edi
xor eax, eax
sub dword [ebp - 0x214], eax
inc eax
cmp eax, 0xb
jl 0x10003f28
cmp dword [ebp - 0x214], 0xffff0001
jge 0x10003f4f
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
je 0x10003f6b
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x214], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x228], ebx
cmp dword [ebp - 0x228], 5
jge 0x10003faa
mov eax, dword [ebp - 0x228]
and eax, reloc.WS2_32.dll_accept
jns 0x10003f8f
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x10003f9c
inc dword [ebp - 0x214]
jmp 0x10003fa2
dec dword [ebp - 0x214]
inc dword [ebp - 0x228]
jmp 0x10003f74
mov dword [ebp - 4], 0xfffffffe
call fcn.10003fdd
xor ecx, ecx
mov eax, ecx
cdq
push 5
pop ebx
idiv ebx
cmp edx, 1
je 0x10003ff8
cmp edx, 4
je 0x10003ff8
and dword [ebp - 0x214], ecx
jmp 0x10004000
nop
nop
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 3
jl 0x10003fb8
xor eax, eax
sub dword [ebp - 0x214], eax
inc eax
cmp eax, 3
jl 0x10004008
mov ebx, 0xffff0001
mov eax, dword [ebp - 0x214]
cmp eax, ebx
jge 0x1000402c
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
cdq
push 7
pop ecx
idiv ecx
test edx, edx
je 0x10004042
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x214], eax
xor eax, eax
sub dword [ebp - 0x214], eax
inc eax
cmp eax, 8
jl 0x10004044
cmp dword [ebp - 0x214], ebx
jge 0x10004067
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
je 0x10004083
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x214], eax
xor eax, eax
xor dword [ebp - 0x214], eax
inc eax
cmp eax, 6
jl 0x10004085
cmp dword [ebp - 0x214], 0
jge 0x100040a0
neg dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
jne 0x100040bc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x214], eax
xor eax, eax
sub dword [ebp - 0x214], eax
inc eax
cmp eax, 8
jl 0x100040be
cmp dword [ebp - 0x214], ebx
jge 0x100040e1
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
je 0x100040fd
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x214], eax
xor eax, eax
xor dword [ebp - 0x214], eax
inc eax
cmp eax, 4
jl 0x100040ff
cmp dword [ebp - 0x214], 0
jge 0x1000411a
neg dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
jne 0x10004136
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x214], eax
xor eax, eax
and dword [ebp - 0x214], eax
inc eax
cmp eax, 4
jl 0x10004138
cmp dword [ebp - 0x214], 0
jge 0x1000415c
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 0xd
pop ecx
idiv ecx
test edx, edx
jne 0x10004178
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x214], eax
xor eax, eax
mov dword [ebp - 0x214], eax
jge 0x1000418b
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
cdq
push 0xd
pop ecx
idiv ecx
test edx, edx
jne 0x100041a1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x214], eax
xor ecx, ecx
mov eax, ecx
cdq
push 5
pop ebx
idiv ebx
cmp edx, 1
je 0x100041bd
cmp edx, 4
je 0x100041bd
and dword [ebp - 0x214], ecx
jmp 0x100041c5
nop
nop
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 2
jl 0x100041a3
mov ecx, dword [ebp - 0x214]
mov dword [ebp - 0x214], ecx
cmp ecx, 0xffff0001
jge 0x100041e8
imul ecx, ecx, 0xfffffffb
mov dword [ebp - 0x214], ecx
mov eax, ecx
cdq
push 7
pop ebx
idiv ebx
test edx, edx
je 0x10004202
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, eax
mov dword [ebp - 0x214], ecx
xor eax, eax
sub ecx, eax
mov dword [ebp - 0x214], ecx
inc eax
cmp eax, 4
jl 0x10004204
cmp ecx, 0xffff0001
jge 0x10004223
imul ecx, ecx, 0xfffffffb
mov dword [ebp - 0x214], ecx
mov eax, ecx
cdq
push 7
pop ebx
idiv ebx
test edx, edx
je 0x1000423d
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, eax
mov dword [ebp - 0x214], ecx
xor eax, eax
and ecx, eax
mov dword [ebp - 0x214], ecx
inc eax
cmp eax, 2
jl 0x1000423f
test ecx, ecx
jns 0x1000425a
imul ecx, ecx, 0xfffffffb
mov dword [ebp - 0x214], ecx
mov eax, ecx
cdq
push 0xd
pop ebx
idiv ebx
test edx, edx
jne 0x10004274
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov dword [ebp - 0x214], ecx
xor eax, eax
and ecx, eax
mov dword [ebp - 0x214], ecx
inc eax
cmp eax, 4
jl 0x10004276
test ecx, ecx
jns 0x10004291
imul ecx, ecx, 0xfffffffb
mov dword [ebp - 0x214], ecx
mov eax, ecx
cdq
push 0xd
pop ebx
idiv ebx
test edx, edx
jne 0x100042ab
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov dword [ebp - 0x214], ecx
mov ebx, ecx
mov dword [ebp - 0x214], ebx
push esi
push esi
call edi
mov dword [ebp - 0x214], ebx
xor ebx, ebx
cmp dword [ebp - 0x214], ebx
jge 0x100042cd
neg dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
jne 0x100042e9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x214], eax
xor eax, eax
xor dword [ebp - 0x214], eax
inc eax
cmp eax, 2
jl 0x100042eb
cmp dword [ebp - 0x214], ebx
jge 0x10004305
neg dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
jne 0x10004321
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x214], eax
mov edi, 0xfa
push edi
lea eax, [ebp - 0x210]
push eax
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call esi
cmp dword [ebp - 0x214], ebx
jge 0x1000434d
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 0xd
pop ecx
idiv ecx
test edx, edx
jne 0x10004369
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x214], eax
cmp eax, ebx
jge 0x1000437f
neg dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
jne 0x1000439b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x214], eax
xor ecx, ecx
mov eax, ecx
cdq
push 5
pop ebx
idiv ebx
cmp edx, 1
je 0x100043b7
cmp edx, 4
je 0x100043b7
and dword [ebp - 0x214], ecx
jmp 0x100043bd
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 4
jl 0x1000439d
push edi
lea eax, [ebp - 0x210]
push eax
call esi
xor ecx, ecx
mov dword [ebp - 0x214], ecx
mov eax, ecx
cdq
push 5
pop ebx
idiv ebx
xor ebx, ebx
inc ebx
cmp edx, ebx
je 0x100043f1
cmp edx, 4
je 0x100043f1
and dword [ebp - 0x214], ecx
jmp 0x100043f7
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 2
jl 0x100043d5
push edi
lea eax, [ebp - 0x210]
push eax
call esi
xor eax, eax
and dword [ebp - 0x214], eax
inc eax
cmp eax, 2
jl 0x10004409
xor esi, esi
cmp dword [ebp - 0x214], esi
jge 0x1000442e
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 0xd
pop ecx
idiv ecx
test edx, edx
jne 0x1000444a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x214], eax
xor eax, eax
and dword [ebp - 0x214], eax
inc eax
cmp eax, 2
jl 0x1000444c
cmp dword [ebp - 0x214], esi
jge 0x1000446f
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 0xd
pop ecx
idiv ecx
test edx, edx
jne 0x1000448b
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x214], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x23c], esi
cmp dword [ebp - 0x23c], esi
jge 0x100044c8
mov eax, dword [ebp - 0x23c]
and eax, reloc.WS2_32.dll_accept
jns 0x100044ae
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, ebx
jne 0x100044ba
inc dword [ebp - 0x214]
jmp 0x100044c0
dec dword [ebp - 0x214]
inc dword [ebp - 0x23c]
jmp 0x10004494
mov dword [ebp - 4], 0xfffffffe
call fcn.1000454b
xor eax, eax
and dword [ebp - 0x214], eax
inc eax
cmp eax, 3
jl 0x100044d6
cmp dword [ebp - 0x214], 0
jge 0x100044fa
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 0xd
pop ecx
idiv ecx
test edx, edx
jne 0x10004516
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x214], eax
push 2
pop eax
mov dword [ebp - 4], eax
and dword [ebp - 0x220], 0
cmp dword [ebp - 0x220], eax
jge 0x10004574
mov ecx, dword [ebp - 0x220]
and ecx, reloc.WS2_32.dll_accept
jns 0x1000453e
dec ecx
or ecx, 0xfffffffe
inc ecx
cmp ecx, 1
jne 0x10004566
inc dword [ebp - 0x214]
jmp 0x1000456c
dec dword [ebp - 0x214]
inc dword [ebp - 0x220]
jmp 0x10004523
mov dword [ebp - 4], 0xfffffffe
call fcn.10004624
xor eax, eax
push 2
pop edi
sub dword [ebp - 0x214], eax
inc eax
cmp eax, edi
jl 0x10004585
mov ebx, 0xffff0001
cmp dword [ebp - 0x214], ebx
jge 0x100045ac
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
je 0x100045c8
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x214], eax
xor eax, eax
sub dword [ebp - 0x214], eax
inc eax
cmp eax, edi
jl 0x100045ca
cmp dword [ebp - 0x214], ebx
jge 0x100045ec
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
je 0x10004608
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x214], eax
xor ecx, ecx
mov eax, ecx
cdq
push 5
pop esi
idiv esi
cmp edx, 1
je 0x1000463f
cmp edx, 4
je 0x1000463f
and dword [ebp - 0x214], ecx
jmp 0x10004645
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, edi
jl 0x1000460a
push 0xfa
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
push 3
pop esi
sub dword [ebp - 0x214], eax
inc eax
cmp eax, esi
jl 0x10004661
cmp dword [ebp - 0x214], ebx
jge 0x10004683
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
je 0x1000469f
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x214], eax
xor eax, eax
and dword [ebp - 0x214], eax
inc eax
cmp eax, edi
jl 0x100046a1
cmp dword [ebp - 0x214], 0
jge 0x100046c4
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 0xd
pop ecx
idiv ecx
test edx, edx
jne 0x100046e0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x214], eax
mov dword [ebp - 4], esi
and dword [ebp - 0x230], 0
cmp dword [ebp - 0x230], esi
jge 0x1000471f
mov eax, dword [ebp - 0x230]
and eax, reloc.WS2_32.dll_accept
jns 0x10004704
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x10004711
inc dword [ebp - 0x214]
jmp 0x10004717
dec dword [ebp - 0x214]
inc dword [ebp - 0x230]
jmp 0x100046ea
mov dword [ebp - 4], 0xfffffffe
call fcn.10004749
xor ecx, ecx
push 4
pop esi
mov eax, ecx
cdq
push 5
pop edi
idiv edi
cmp edx, 1
je 0x10004764
cmp edx, esi
je 0x10004764
and dword [ebp - 0x214], ecx
jmp 0x1000476a
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 3
jl 0x10004730
push 0xfa
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [ebp - 4], esi
and dword [ebp - 0x218], 0
cmp dword [ebp - 0x218], 2
jge 0x100047c2
mov eax, dword [ebp - 0x218]
and eax, reloc.WS2_32.dll_accept
jns 0x100047a7
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x100047b4
inc dword [ebp - 0x214]
jmp 0x100047ba
dec dword [ebp - 0x214]
inc dword [ebp - 0x218]
jmp 0x1000478c
mov dword [ebp - 4], 0xfffffffe
call fcn.10004846
xor eax, eax
and dword [ebp - 0x214], eax
inc eax
cmp eax, 3
jl 0x100047d0
cmp dword [ebp - 0x214], 0
jge 0x100047f4
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 0xd
pop ecx
idiv ecx
test edx, edx
jne 0x10004810
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x214], eax
mov dword [ebp - 4], 5
and dword [ebp - 0x238], 0
cmp dword [ebp - 0x238], 2
jge 0x1000486f
mov eax, dword [ebp - 0x238]
and eax, reloc.WS2_32.dll_accept
jns 0x10004839
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x10004861
inc dword [ebp - 0x214]
jmp 0x10004867
dec dword [ebp - 0x214]
inc dword [ebp - 0x238]
jmp 0x1000481e
mov dword [ebp - 4], 0xfffffffe
call fcn.100048b1
mov dword [ebp - 4], 6
and dword [ebp - 0x21c], 0
cmp dword [ebp - 0x21c], 0
jge 0x100048da
mov eax, dword [ebp - 0x21c]
and eax, reloc.WS2_32.dll_accept
jns 0x100048a4
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x100048cc
inc dword [ebp - 0x214]
jmp 0x100048d2
dec dword [ebp - 0x214]
inc dword [ebp - 0x21c]
jmp 0x10004889
mov dword [ebp - 4], 0xfffffffe
call fcn.10004971
xor eax, eax
and dword [ebp - 0x214], eax
inc eax
cmp eax, 3
jl 0x100048e8
cmp dword [ebp - 0x214], 0
jge 0x1000490c
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 0xd
pop ecx
idiv ecx
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test edx, edx
jne 0x1000492a
call esi
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jge 0x10004939
neg dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
jne 0x10004955
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x214], eax
xor ecx, ecx
mov eax, ecx
cdq
push 5
pop edi
idiv edi
cmp edx, 1
je 0x1000498c
cmp edx, 4
je 0x1000498c
and dword [ebp - 0x214], ecx
jmp 0x10004992
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 3
jl 0x10004957
push 0xfa
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
sub dword [ebp - 0x214], eax
inc eax
cmp eax, 2
jl 0x100049ac
mov edi, 0xffff0001
cmp dword [ebp - 0x214], edi
jge 0x100049d4
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
je 0x100049f0
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x214], eax
xor ecx, ecx
mov dword [ebp - 0x214], ecx
jge 0x10004a03
imul ecx, ecx, 0xfffffffb
mov dword [ebp - 0x214], ecx
mov eax, ecx
cdq
push 0xd
pop ebx
idiv ebx
test edx, edx
jne 0x10004a19
call esi
mov ecx, eax
mov dword [ebp - 0x214], ecx
mov eax, ecx
mov dword [ebp - 0x214], eax
cmp eax, edi
jge 0x10004a2e
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
cdq
push 7
pop edi
mov ecx, edi
idiv ecx
test edx, edx
je 0x10004a46
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x214], eax
xor eax, eax
mov dword [ebp - 0x214], eax
jge 0x10004a59