Function at 0x4a43a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4ba428
push 0x40d810
mov eax, dword fs:[0]
push eax
add esp, 0xfffff4d4
mov eax, dword [0x4bc534]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x4c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 0
jmp 0x4a43f6
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x4a4427
mov ecx, dword [ebp - 0x20]
and ecx, 0x80000001
jns 0x4a440c
dec ecx
or ecx, 0xfffffffe
inc ecx
cmp ecx, 1
jne 0x4a441c
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x4a4425
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [ebp - 0x1c], eax
jmp 0x4a43ed
mov dword [ebp - 4], 0xfffffffe
call fcn.004a4435
jmp 0x4a4453
mov dword [ebp - 4], 1
mov dword [ebp - 0x24], 0
jmp 0x4a446c
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xf
jge 0x4a44a2
mov eax, dword [ebp - 0x24]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x4a4492
mov eax, dword [ebp - 0x24]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x4a449d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1c], eax
jmp 0x4a44a0
mov dword [ebp - 0x1c], eax
jmp 0x4a4463
mov dword [ebp - 4], 0xfffffffe
call fcn.004a44b0
jmp 0x4a44b8
mov dword [ebp - 0x28], 0
jmp 0x4a44ca
mov edx, dword [ebp - 0x28]
add edx, 1
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], 0xf
jge 0x4a44dd
mov eax, dword [ebp - 0x28]
not eax
xor eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x4a44c1
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4a44f1
mov ecx, dword [ebp - 0x1c]
neg ecx
imul ecx, ecx, 0xfffffffd
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4a4507
mov dword [ebp - 0x1c], 0xb
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x34], 2
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], 0
jmp 0x4a4535
mov edx, dword [ebp - 0x3c]
add edx, 1
mov dword [ebp - 0x3c], edx
cmp dword [ebp - 0x3c], 5
jge 0x4a455b
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x1c], eax
jmp 0x4a452c
mov ecx, dword [ebp - 0x1c]
add ecx, 5
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 2
mov dword [ebp - 0x40], 0
jmp 0x4a457d
mov edx, dword [ebp - 0x40]
add edx, 1
mov dword [ebp - 0x40], edx
cmp dword [ebp - 0x40], 0x1d
jge 0x4a45b3
mov eax, dword [ebp - 0x40]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x4a45a3
mov eax, dword [ebp - 0x40]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x4a45ae
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1c], eax
jmp 0x4a45b1
mov dword [ebp - 0x1c], eax
jmp 0x4a4574
mov dword [ebp - 4], 0xfffffffe
call fcn.004a45c1
jmp 0x4a45c9
mov dword [ebp - 0x44], 0
jmp 0x4a45db
mov edx, dword [ebp - 0x44]
add edx, 1
mov dword [ebp - 0x44], edx
cmp dword [ebp - 0x44], 0xe
jge 0x4a45ee
mov eax, dword [ebp - 0x44]
not eax
xor eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x4a45d2
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4a4602
mov ecx, dword [ebp - 0x1c]
neg ecx
imul ecx, ecx, 0xfffffffd
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4a4618
mov dword [ebp - 0x1c], 0xb
mov dword [ebp - 0x48], 0
jmp 0x4a462a
mov edx, dword [ebp - 0x48]
add edx, 1
mov dword [ebp - 0x48], edx
cmp dword [ebp - 0x48], 4
jge 0x4a4668
cmp dword [ebp - 0x1c], 0
jge 0x4a463e
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4a4654
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x248]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4a4621
mov dword [ebp - 4], 3
mov dword [ebp - 0x24c], 0
jmp 0x4a468a
mov eax, dword [ebp - 0x24c]
add eax, 1
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 4
jge 0x4a46c9
mov eax, dword [ebp - 0x24c]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x4a46b9
mov eax, dword [ebp - 0x24c]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x4a46c4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1c], eax
jmp 0x4a46c7
mov dword [ebp - 0x1c], eax
jmp 0x4a467b
mov dword [ebp - 4], 0xfffffffe
call fcn.004a46d7
jmp 0x4a46df
mov dword [ebp - 4], 4
mov dword [ebp - 0x250], 0
jmp 0x4a4701
mov edx, dword [ebp - 0x250]
add edx, 1
mov dword [ebp - 0x250], edx
cmp dword [ebp - 0x250], 0xf
jge 0x4a4748
mov eax, dword [ebp - 0x1c]
cdq
sub eax, edx
sar eax, 1
and eax, 0x80000001
jns 0x4a471e
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x4a472e
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x4a4746
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4a4746
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x4a46f2
mov dword [ebp - 4], 0xfffffffe
call fcn.004a4756
jmp 0x4a4765
mov dword [ebp - 0x254], 0
jmp 0x4a4780
mov ecx, dword [ebp - 0x254]
add ecx, 1
mov dword [ebp - 0x254], ecx
cmp dword [ebp - 0x254], 0x10
jge 0x4a47c1
cmp dword [ebp - 0x1c], 0
jge 0x4a4797
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4a47ad
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x450]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4a4771
mov dword [ebp - 4], 5
mov dword [ebp - 0x454], 0
jmp 0x4a47e3
mov eax, dword [ebp - 0x454]
add eax, 1
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 8
jge 0x4a481a
mov ecx, dword [ebp - 0x454]
and ecx, 0x80000001
jns 0x4a47ff
dec ecx
or ecx, 0xfffffffe
inc ecx
cmp ecx, 1
jne 0x4a480f
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x4a4818
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [ebp - 0x1c], eax
jmp 0x4a47d4
mov dword [ebp - 4], 0xfffffffe
call fcn.004a4828
jmp 0x4a4846
mov dword [ebp - 0x458], 1
mov dword [ebp - 0x45c], 1
mov dword [ebp - 0x460], 2
mov dword [ebp - 0x464], 0
mov dword [ebp - 0x468], 0
jmp 0x4a4889
mov eax, dword [ebp - 0x468]
add eax, 1
mov dword [ebp - 0x468], eax
cmp dword [ebp - 0x468], 7
jge 0x4a48ca
mov ecx, dword [ebp - 0x458]
add ecx, dword [ebp - 0x45c]
mov dword [ebp - 0x460], ecx
mov edx, dword [ebp - 0x45c]
mov dword [ebp - 0x458], edx
mov eax, dword [ebp - 0x460]
mov dword [ebp - 0x45c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x460]
mov dword [ebp - 0x1c], ecx
jmp 0x4a487a
mov edx, dword [ebp - 0x1c]
add edx, 7
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x46c], 1
mov dword [ebp - 0x470], 1
mov dword [ebp - 0x474], 2
mov dword [ebp - 0x478], 0
mov dword [ebp - 0x47c], 0
jmp 0x4a4916
mov eax, dword [ebp - 0x47c]
add eax, 1
mov dword [ebp - 0x47c], eax
cmp dword [ebp - 0x47c], 0xf
jge 0x4a4957
mov ecx, dword [ebp - 0x46c]
add ecx, dword [ebp - 0x470]
mov dword [ebp - 0x474], ecx
mov edx, dword [ebp - 0x470]
mov dword [ebp - 0x46c], edx
mov eax, dword [ebp - 0x474]
mov dword [ebp - 0x470], eax
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x474]
mov dword [ebp - 0x1c], ecx
jmp 0x4a4907
mov edx, dword [ebp - 0x1c]
add edx, 0xf
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x480], 1
mov dword [ebp - 0x484], 1
mov dword [ebp - 0x488], 2
mov dword [ebp - 0x48c], 0
mov dword [ebp - 0x490], 0
jmp 0x4a49a3
mov eax, dword [ebp - 0x490]
add eax, 1
mov dword [ebp - 0x490], eax
cmp dword [ebp - 0x490], 6
jge 0x4a49e4
mov ecx, dword [ebp - 0x480]
add ecx, dword [ebp - 0x484]
mov dword [ebp - 0x488], ecx
mov edx, dword [ebp - 0x484]
mov dword [ebp - 0x480], edx
mov eax, dword [ebp - 0x488]
mov dword [ebp - 0x484], eax
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x488]
mov dword [ebp - 0x1c], ecx
jmp 0x4a4994
mov edx, dword [ebp - 0x1c]
add edx, 6
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x494], 0
jmp 0x4a4a08
mov eax, dword [ebp - 0x494]
add eax, 1
mov dword [ebp - 0x494], eax
cmp dword [ebp - 0x494], 0xc
jge 0x4a4a21
mov ecx, dword [ebp - 0x494]
not ecx
xor ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ecx
jmp 0x4a49f9
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4a4a35
mov edx, dword [ebp - 0x1c]
neg edx
imul edx, edx, 0xfffffffd
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4a4a4b
mov dword [ebp - 0x1c], 0xb
mov dword [ebp - 0x498], 1
mov dword [ebp - 0x49c], 1
mov dword [ebp - 0x4a0], 2
mov dword [ebp - 0x4a4], 0
mov dword [ebp - 0x4a8], 0
jmp 0x4a4a8e
mov edx, dword [ebp - 0x4a8]
add edx, 1
mov dword [ebp - 0x4a8], edx
cmp dword [ebp - 0x4a8], 4
jge 0x4a4acf
mov eax, dword [ebp - 0x498]
add eax, dword [ebp - 0x49c]
mov dword [ebp - 0x4a0], eax
mov ecx, dword [ebp - 0x49c]
mov dword [ebp - 0x498], ecx
mov edx, dword [ebp - 0x4a0]
mov dword [ebp - 0x49c], edx
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x4a0]
mov dword [ebp - 0x1c], eax
jmp 0x4a4a7f
mov ecx, dword [ebp - 0x1c]
add ecx, 4
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 6
mov dword [ebp - 0x4ac], 0
jmp 0x4a4afa
mov edx, dword [ebp - 0x4ac]
add edx, 1
mov dword [ebp - 0x4ac], edx
cmp dword [ebp - 0x4ac], 3
jge 0x4a4b41
mov eax, dword [ebp - 0x1c]
cdq
sub eax, edx
sar eax, 1
and eax, 0x80000001
jns 0x4a4b17
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x4a4b27
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x4a4b3f
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4a4b3f
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x4a4aeb
mov dword [ebp - 4], 0xfffffffe
call fcn.004a4b4f
jmp 0x4a4b5e
mov dword [ebp - 4], 7
mov dword [ebp - 0x4b0], 0
jmp 0x4a4b80
mov ecx, dword [ebp - 0x4b0]
add ecx, 1
mov dword [ebp - 0x4b0], ecx
cmp dword [ebp - 0x4b0], 2
jge 0x4a4bb7
mov edx, dword [ebp - 0x4b0]
and edx, 0x80000001
jns 0x4a4b9c
dec edx
or edx, 0xfffffffe
inc edx
cmp edx, 1
jne 0x4a4bac
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
jmp 0x4a4bb5
mov ecx, dword [ebp - 0x1c]
sub ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4a4b71
mov dword [ebp - 4], 0xfffffffe
call fcn.004a4bc5
jmp 0x4a4be3
mov dword [ebp - 0x4b4], 0
jmp 0x4a4bfe
mov ecx, dword [ebp - 0x4b4]
add ecx, 1
mov dword [ebp - 0x4b4], ecx
cmp dword [ebp - 0x4b4], 3
jge 0x4a4c3f
cmp dword [ebp - 0x1c], 0
jge 0x4a4c15
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4a4c2b
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x6b0]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4a4bef
mov dword [ebp - 4], 8
mov dword [ebp - 0x6b4], 0
jmp 0x4a4c61
mov eax, dword [ebp - 0x6b4]
add eax, 1
mov dword [ebp - 0x6b4], eax
cmp dword [ebp - 0x6b4], 0xf
jge 0x4a4c98
mov ecx, dword [ebp - 0x6b4]
and ecx, 0x80000001
jns 0x4a4c7d
dec ecx
or ecx, 0xfffffffe
inc ecx
cmp ecx, 1
jne 0x4a4c8d
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x4a4c96
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [ebp - 0x1c], eax
jmp 0x4a4c52
mov dword [ebp - 4], 0xfffffffe
call fcn.004a4ca6
jmp 0x4a4cc4
mov dword [ebp - 0x6b8], 0
jmp 0x4a4cdf
mov eax, dword [ebp - 0x6b8]
add eax, 1
mov dword [ebp - 0x6b8], eax
cmp dword [ebp - 0x6b8], 9
jge 0x4a4cf8
mov ecx, dword [ebp - 0x6b8]
not ecx
xor ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ecx
jmp 0x4a4cd0
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4a4d0c
mov edx, dword [ebp - 0x1c]
neg edx
imul edx, edx, 0xfffffffd
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4a4d22
mov dword [ebp - 0x1c], 0xb
mov dword [ebp - 4], 9
mov dword [ebp - 0x6bc], 0
jmp 0x4a4d44
mov edx, dword [ebp - 0x6bc]
add edx, 1
mov dword [ebp - 0x6bc], edx
cmp dword [ebp - 0x6bc], 8
jge 0x4a4d7a
mov eax, dword [ebp - 0x6bc]
and eax, 0x80000001
jns 0x4a4d5f
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x4a4d6f
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4a4d78
mov edx, dword [ebp - 0x1c]
sub edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x4a4d35
mov dword [ebp - 4], 0xfffffffe
call fcn.004a4d88
jmp 0x4a4da5
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x6c0], 0
jmp 0x4a4dc7
mov edx, dword [ebp - 0x6c0]
add edx, 1
mov dword [ebp - 0x6c0], edx
cmp dword [ebp - 0x6c0], 0
jge 0x4a4e02
mov eax, dword [ebp - 0x6c0]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x4a4df6
mov eax, dword [ebp - 0x6c0]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x4a4dfd
and eax, 0xbc614e
jmp 0x4a4e00
mov dword [ebp - 0x1c], eax
jmp 0x4a4db8
mov dword [ebp - 4], 0xfffffffe
call fcn.004a4e10
jmp 0x4a4e18
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x6c4], 0
jmp 0x4a4e3a
mov edx, dword [ebp - 0x6c4]
add edx, 1
mov dword [ebp - 0x6c4], edx
cmp dword [ebp - 0x6c4], 5
jge 0x4a4e81
mov eax, dword [ebp - 0x1c]
cdq
sub eax, edx
sar eax, 1
and eax, 0x80000001
jns 0x4a4e57
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x4a4e67
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x4a4e7f
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4a4e7f
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x4a4e2b
mov dword [ebp - 4], 0xfffffffe
call fcn.004a4e8f
jmp 0x4a4e9e
mov dword [ebp - 0x6c8], 0
jmp 0x4a4eb9
mov ecx, dword [ebp - 0x6c8]
add ecx, 1
mov dword [ebp - 0x6c8], ecx
cmp dword [ebp - 0x6c8], 0
jge 0x4a4ed2
mov edx, dword [ebp - 0x6c8]
not edx
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x4a4eaa
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4a4ee6
mov eax, dword [ebp - 0x1c]
neg eax
imul eax, eax, 0xfffffffd
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4a4efc
mov dword [ebp - 0x1c], 0xb
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x6cc], 0
jmp 0x4a4f1e
mov edx, dword [ebp - 0x6cc]
add edx, 1
mov dword [ebp - 0x6cc], edx
cmp dword [ebp - 0x6cc], 0
jge 0x4a4f65
mov eax, dword [ebp - 0x1c]
cdq
sub eax, edx
sar eax, 1
and eax, 0x80000001
jns 0x4a4f3b
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x4a4f4b
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x4a4f63
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4a4f63
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x4a4f0f
mov dword [ebp - 4], 0xfffffffe
call fcn.004a4f73
jmp 0x4a4f82
mov dword [ebp - 0x6d0], 0
jmp 0x4a4f9d
mov ecx, dword [ebp - 0x6d0]
add ecx, 1
mov dword [ebp - 0x6d0], ecx
cmp dword [ebp - 0x6d0], 8
jge 0x4a4fde
cmp dword [ebp - 0x1c], 0
jge 0x4a4fb4
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4a4fca
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x8c8]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4a4f8e
mov dword [ebp - 0x8cc], 0
jmp 0x4a4ff9
mov eax, dword [ebp - 0x8cc]
add eax, 1
mov dword [ebp - 0x8cc], eax
cmp dword [ebp - 0x8cc], 3
jge 0x4a5012
mov ecx, dword [ebp - 0x8cc]
not ecx
xor ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ecx
jmp 0x4a4fea
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4a5026
mov edx, dword [ebp - 0x1c]
neg edx
imul edx, edx, 0xfffffffd
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4a503c
mov dword [ebp - 0x1c], 0xb
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x8d0], 0
jmp 0x4a505e
mov edx, dword [ebp - 0x8d0]
add edx, 1
mov dword [ebp - 0x8d0], edx
cmp dword [ebp - 0x8d0], 0
jge 0x4a5094
mov eax, dword [ebp - 0x8d0]
and eax, 0x80000001
jns 0x4a5079
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x4a5089
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4a5092
mov edx, dword [ebp - 0x1c]
sub edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x4a504f
mov dword [ebp - 4], 0xfffffffe
call fcn.004a50a2
jmp 0x4a50bf
mov dword [ebp - 0x8d4], 0
jmp 0x4a50da
mov edx, dword [ebp - 0x8d4]
add edx, 1
mov dword [ebp - 0x8d4], edx
cmp dword [ebp - 0x8d4], 8
jge 0x4a50f3
mov eax, dword [ebp - 0x8d4]
not eax
xor eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x4a50cb
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4a5107
mov ecx, dword [ebp - 0x1c]
neg ecx
imul ecx, ecx, 0xfffffffd
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4a511d
mov dword [ebp - 0x1c], 0xb
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x8d8], 0
jmp 0x4a513f
mov edx, dword [ebp - 0x8d8]
add edx, 1
mov dword [ebp - 0x8d8], edx
cmp dword [ebp - 0x8d8], 8
jge 0x4a517a
mov eax, dword [ebp - 0x8d8]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x4a516e
mov eax, dword [ebp - 0x8d8]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x4a5175
and eax, 0xbc614e
jmp 0x4a5178
mov dword [ebp - 0x1c], eax
jmp 0x4a5130
mov dword [ebp - 4], 0xfffffffe
call fcn.004a5188
jmp 0x4a5190
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x8dc], 0
jmp 0x4a51b2
mov edx, dword [ebp - 0x8dc]
add edx, 1
mov dword [ebp - 0x8dc], edx
cmp dword [ebp - 0x8dc], 6
jge 0x4a51e8
mov eax, dword [ebp - 0x8dc]
and eax, 0x80000001
jns 0x4a51cd
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x4a51dd
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4a51e6
mov edx, dword [ebp - 0x1c]
sub edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x4a51a3
mov dword [ebp - 4], 0xfffffffe
call fcn.004a51f6
jmp 0x4a5213
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x8e0], 0
jmp 0x4a5235
mov edx, dword [ebp - 0x8e0]
add edx, 1
mov dword [ebp - 0x8e0], edx
cmp dword [ebp - 0x8e0], 2
jge 0x4a5270
mov eax, dword [ebp - 0x8e0]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x4a5264
mov eax, dword [ebp - 0x8e0]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x4a526b
and eax, 0xbc614e
jmp 0x4a526e
mov dword [ebp - 0x1c], eax
jmp 0x4a5226
mov dword [ebp - 4], 0xfffffffe
call fcn.004a527e
jmp 0x4a5286
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x8e4], 0
jmp 0x4a52a8
mov edx, dword [ebp - 0x8e4]
add edx, 1
mov dword [ebp - 0x8e4], edx
cmp dword [ebp - 0x8e4], 1
jge 0x4a52e3
mov eax, dword [ebp - 0x8e4]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x4a52d7
mov eax, dword [ebp - 0x8e4]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x4a52de
and eax, 0xbc614e
jmp 0x4a52e1
mov dword [ebp - 0x1c], eax
jmp 0x4a5299
mov dword [ebp - 4], 0xfffffffe
call fcn.004a52f1
jmp 0x4a52f9
mov dword [ebp - 0x8e8], 0
jmp 0x4a5314
mov edx, dword [ebp - 0x8e8]
add edx, 1
mov dword [ebp - 0x8e8], edx
cmp dword [ebp - 0x8e8], 1
jge 0x4a532d
mov eax, dword [ebp - 0x8e8]
not eax
xor eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x4a5305
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4a5341
mov ecx, dword [ebp - 0x1c]
neg ecx
imul ecx, ecx, 0xfffffffd
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4a5357
mov dword [ebp - 0x1c], 0xb
mov dword [ebp - 0x8ec], 0
jmp 0x4a5372
mov edx, dword [ebp - 0x8ec]
add edx, 1
mov dword [ebp - 0x8ec], edx
cmp dword [ebp - 0x8ec], 4
jge 0x4a53b3
cmp dword [ebp - 0x1c], 0
jge 0x4a5389
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4a539f
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0xae8]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4a5363
mov dword [ebp - 4], 0x12
mov dword [ebp - 0xaec], 0
jmp 0x4a53d5
mov eax, dword [ebp - 0xaec]
add eax, 1
mov dword [ebp - 0xaec], eax
cmp dword [ebp - 0xaec], 1
jge 0x4a5410
mov eax, dword [ebp - 0xaec]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x4a5404
mov eax, dword [ebp - 0xaec]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x4a540b
and eax, 0xbc614e
jmp 0x4a540e
mov dword [ebp - 0x1c], eax
jmp 0x4a53c6
mov dword [ebp - 4], 0xfffffffe
call fcn.004a541e
jmp 0x4a5426
mov dword [ebp - 4], 0x13
mov dword [ebp - 0xaf0], 0
jmp 0x4a5448
mov edx, dword [ebp - 0xaf0]
add edx, 1
mov dword [ebp - 0xaf0], edx
cmp dword [ebp - 0xaf0], 0
jge 0x4a547e
mov eax, dword [ebp - 0xaf0]
and eax, 0x80000001
jns 0x4a5463
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x4a5473
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4a547c
mov edx, dword [ebp - 0x1c]
sub edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x4a5439
mov dword [ebp - 4], 0xfffffffe
call fcn.004a548c
jmp 0x4a54a9
mov dword [ebp - 0xaf4], 1
mov dword [ebp - 0xaf8], 1
mov dword [ebp - 0xafc], 2
mov dword [ebp - 0xb00], 0
mov dword [ebp - 0xb04], 0
jmp 0x4a54ec
mov edx, dword [ebp - 0xb04]
add edx, 1
mov dword [ebp - 0xb04], edx
cmp dword [ebp - 0xb04], 1
jge 0x4a552d
mov eax, dword [ebp - 0xaf4]
add eax, dword [ebp - 0xaf8]
mov dword [ebp - 0xafc], eax
mov ecx, dword [ebp - 0xaf8]
mov dword [ebp - 0xaf4], ecx
mov edx, dword [ebp - 0xafc]
mov dword [ebp - 0xaf8], edx
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0xafc]
mov dword [ebp - 0x1c], eax
jmp 0x4a54dd
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0xb08], 1
mov dword [ebp - 0xb0c], 1
mov dword [ebp - 0xb10], 2
mov dword [ebp - 0xb14], 0
mov dword [ebp - 0xb18], 0
jmp 0x4a5579
mov edx, dword [ebp - 0xb18]
add edx, 1
mov dword [ebp - 0xb18], edx
cmp dword [ebp - 0xb18], 2
jge 0x4a55ba
mov eax, dword [ebp - 0xb08]
add eax, dword [ebp - 0xb0c]
mov dword [ebp - 0xb10], eax
mov ecx, dword [ebp - 0xb0c]
mov dword [ebp - 0xb08], ecx
mov edx, dword [ebp - 0xb10]
mov dword [ebp - 0xb0c], edx
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0xb10]
mov dword [ebp - 0x1c], eax
jmp 0x4a556a
mov ecx, dword [ebp - 0x1c]
add ecx, 2
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0x14
mov dword [ebp - 0xb1c], 0
jmp 0x4a55e5
mov edx, dword [ebp - 0xb1c]
add edx, 1
mov dword [ebp - 0xb1c], edx
cmp dword [ebp - 0xb1c], 2
jge 0x4a5624
mov eax, dword [ebp - 0xb1c]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x4a5614
mov eax, dword [ebp - 0xb1c]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x4a561f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1c], eax
jmp 0x4a5622
mov dword [ebp - 0x1c], eax
jmp 0x4a55d6
mov dword [ebp - 4], 0xfffffffe
call fcn.004a5632
jmp 0x4a563a
mov dword [ebp - 4], 0x15
mov dword [ebp - 0xb20], 0
jmp 0x4a565c
mov edx, dword [ebp - 0xb20]
add edx, 1
mov dword [ebp - 0xb20], edx
cmp dword [ebp - 0xb20], 4
jge 0x4a569b
mov eax, dword [ebp - 0xb20]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x4a568b
mov eax, dword [ebp - 0xb20]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x4a5696
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1c], eax
jmp 0x4a5699
mov dword [ebp - 0x1c], eax
jmp 0x4a564d
mov dword [ebp - 4], 0xfffffffe
call fcn.004a56a9
jmp 0x4a56b1
mov dword [ebp - 4], 0x16
mov dword [ebp - 0xb24], 0
jmp 0x4a56d3
mov edx, dword [ebp - 0xb24]
add edx, 1
mov dword [ebp - 0xb24], edx
cmp dword [ebp - 0xb24], 2
jge 0x4a5712
mov eax, dword [ebp - 0xb24]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x4a5702
mov eax, dword [ebp - 0xb24]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x4a570d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1c], eax
jmp 0x4a5710
mov dword [ebp - 0x1c], eax
jmp 0x4a56c4
mov dword [ebp - 4], 0xfffffffe
call fcn.004a5720
jmp 0x4a5728
mov dword [ebp - 0xb28], 1
mov dword [ebp - 0xb2c], 1
mov dword [ebp - 0xb30], 2
mov dword [ebp - 0xb34], 0
mov dword [ebp - 0xb38], 0
jmp 0x4a576b
mov edx, dword [ebp - 0xb38]
add edx, 1
mov dword [ebp - 0xb38], edx
cmp dword [ebp - 0xb38], 0
jge 0x4a57ac
mov eax, dword [ebp - 0xb28]
add eax, dword [ebp - 0xb2c]
mov dword [ebp - 0xb30], eax
mov ecx, dword [ebp - 0xb2c]
mov dword [ebp - 0xb28], ecx
mov edx, dword [ebp - 0xb30]
mov dword [ebp - 0xb2c], edx
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0xb30]
mov dword [ebp - 0x1c], eax
jmp 0x4a575c
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0x17
mov dword [ebp - 0xb3c], 0
jmp 0x4a57d4
cmp dword [ebp - 0xb3c], 0
jge 0x4a580f