Function at 0x427bd0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4b2a38
push 0x40d810
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x1154
call fcn.004175a0
mov eax, dword [0x4bc534]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x28], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 0
jmp 0x427c2d
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 6
jge 0x427c71
mov eax, dword [ebp - 0x1c]
cdq
sub eax, edx
sar eax, 1
and eax, 0x80000001
jns 0x427c47
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x427c57
mov ecx, dword [ebp - 0x1c]
and ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ecx
jmp 0x427c6f
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x427c6f
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x427c24
mov dword [ebp - 4], 0xfffffffe
call fcn.00427c7f
jmp 0x427c8e
mov dword [ebp - 0x24], 0
jmp 0x427ca0
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 0x14
jge 0x427cde
cmp dword [ebp - 0x1c], 0
jge 0x427cb4
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x427cca
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x220]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x427c97
mov dword [ebp - 4], 1
mov dword [ebp - 0x224], 0
jmp 0x427d00
mov eax, dword [ebp - 0x224]
add eax, 1
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0x1d
jge 0x427d37
mov ecx, dword [ebp - 0x224]
and ecx, 0x80000001
jns 0x427d1c
dec ecx
or ecx, 0xfffffffe
inc ecx
cmp ecx, 1
jne 0x427d2c
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x427d35
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [ebp - 0x1c], eax
jmp 0x427cf1
mov dword [ebp - 4], 0xfffffffe
call fcn.00427d45
jmp 0x427d63
mov dword [ebp - 4], 2
mov dword [ebp - 0x228], 0
jmp 0x427d85
mov eax, dword [ebp - 0x228]
add eax, 1
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0x1e
jge 0x427dc0
mov eax, dword [ebp - 0x228]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x427db4
mov eax, dword [ebp - 0x228]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x427dbb
and eax, 0xbc614e
jmp 0x427dbe
mov dword [ebp - 0x1c], eax
jmp 0x427d76
mov dword [ebp - 4], 0xfffffffe
call fcn.00427dce
jmp 0x427dd6
mov dword [ebp - 4], 3
mov dword [ebp - 0x22c], 0
jmp 0x427df8
mov edx, dword [ebp - 0x22c]
add edx, 1
mov dword [ebp - 0x22c], edx
cmp dword [ebp - 0x22c], 0x1d
jge 0x427e2e
mov eax, dword [ebp - 0x22c]
and eax, 0x80000001
jns 0x427e13
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x427e23
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x427e2c
mov edx, dword [ebp - 0x1c]
sub edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x427de9
mov dword [ebp - 4], 0xfffffffe
call fcn.00427e3c
jmp 0x427e59
mov dword [ebp - 0x230], 0
jmp 0x427e74
mov edx, dword [ebp - 0x230]
add edx, 1
mov dword [ebp - 0x230], edx
cmp dword [ebp - 0x230], 0x1f
jge 0x427eb5
cmp dword [ebp - 0x1c], 0
jge 0x427e8b
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x427ea1
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x428]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x427e65
mov dword [ebp - 0x42c], 0
jmp 0x427ed0
mov eax, dword [ebp - 0x42c]
add eax, 1
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0xb
jge 0x427ee9
mov ecx, dword [ebp - 0x42c]
not ecx
xor ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ecx
jmp 0x427ec1
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x427efd
mov edx, dword [ebp - 0x1c]
neg edx
imul edx, edx, 0xfffffffd
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x427f13
mov dword [ebp - 0x1c], 0xb
mov dword [ebp - 4], 4
mov dword [ebp - 0x430], 0
jmp 0x427f35
mov edx, dword [ebp - 0x430]
add edx, 1
mov dword [ebp - 0x430], edx
cmp dword [ebp - 0x430], 0x1c
jge 0x427f6b
mov eax, dword [ebp - 0x430]
and eax, 0x80000001
jns 0x427f50
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x427f60
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x427f69
mov edx, dword [ebp - 0x1c]
sub edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x427f26
mov dword [ebp - 4], 0xfffffffe
call fcn.00427f79
jmp 0x427f96
mov dword [ebp - 0x434], 0
jmp 0x427fb1
mov edx, dword [ebp - 0x434]
add edx, 1
mov dword [ebp - 0x434], edx
cmp dword [ebp - 0x434], 0x20
jge 0x427ff2
cmp dword [ebp - 0x1c], 0
jge 0x427fc8
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x427fde
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x630]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x427fa2
mov dword [ebp - 4], 5
mov dword [ebp - 0x634], 0
jmp 0x428014
mov eax, dword [ebp - 0x634]
add eax, 1
mov dword [ebp - 0x634], eax
cmp dword [ebp - 0x634], 2
jge 0x428053
mov eax, dword [ebp - 0x634]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x428043
mov eax, dword [ebp - 0x634]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x42804e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1c], eax
jmp 0x428051
mov dword [ebp - 0x1c], eax
jmp 0x428005
mov dword [ebp - 4], 0xfffffffe
call fcn.00428061
jmp 0x428069
mov dword [ebp - 4], 6
mov dword [ebp - 0x638], 0
jmp 0x42808b
mov edx, dword [ebp - 0x638]
add edx, 1
mov dword [ebp - 0x638], edx
cmp dword [ebp - 0x638], 6
jge 0x4280c1
mov eax, dword [ebp - 0x638]
and eax, 0x80000001
jns 0x4280a6
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x4280b6
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4280bf
mov edx, dword [ebp - 0x1c]
sub edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x42807c
mov dword [ebp - 4], 0xfffffffe
call fcn.004280cf
jmp 0x4280ec
mov dword [ebp - 4], 7
mov dword [ebp - 0x63c], 0
jmp 0x42810e
mov edx, dword [ebp - 0x63c]
add edx, 1
mov dword [ebp - 0x63c], edx
cmp dword [ebp - 0x63c], 0
jge 0x428144
mov eax, dword [ebp - 0x63c]
and eax, 0x80000001
jns 0x428129
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x428139
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x428142
mov edx, dword [ebp - 0x1c]
sub edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x4280ff
mov dword [ebp - 4], 0xfffffffe
call fcn.00428152
jmp 0x42816f
mov dword [ebp - 0x640], 1
mov dword [ebp - 0x644], 1
mov dword [ebp - 0x648], 2
mov dword [ebp - 0x64c], 0
mov dword [ebp - 0x650], 0
jmp 0x4281b2
mov edx, dword [ebp - 0x650]
add edx, 1
mov dword [ebp - 0x650], edx
cmp dword [ebp - 0x650], 0x10
jge 0x4281f3
mov eax, dword [ebp - 0x640]
add eax, dword [ebp - 0x644]
mov dword [ebp - 0x648], eax
mov ecx, dword [ebp - 0x644]
mov dword [ebp - 0x640], ecx
mov edx, dword [ebp - 0x648]
mov dword [ebp - 0x644], edx
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x648]
mov dword [ebp - 0x1c], eax
jmp 0x4281a3
mov ecx, dword [ebp - 0x1c]
add ecx, 0x10
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x654], 0
jmp 0x428217
mov edx, dword [ebp - 0x654]
add edx, 1
mov dword [ebp - 0x654], edx
cmp dword [ebp - 0x654], 0x10
jge 0x428230
mov eax, dword [ebp - 0x654]
not eax
xor eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x428208
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x428244
mov ecx, dword [ebp - 0x1c]
neg ecx
imul ecx, ecx, 0xfffffffd
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x42825a
mov dword [ebp - 0x1c], 0xb
mov dword [ebp - 4], 8
mov dword [ebp - 0x658], 0
jmp 0x42827c
mov edx, dword [ebp - 0x658]
add edx, 1
mov dword [ebp - 0x658], edx
cmp dword [ebp - 0x658], 1
jge 0x4282b2
mov eax, dword [ebp - 0x658]
and eax, 0x80000001
jns 0x428297
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x4282a7
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4282b0
mov edx, dword [ebp - 0x1c]
sub edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x42826d
mov dword [ebp - 4], 0xfffffffe
call fcn.004282c0
jmp 0x4282dd
mov dword [ebp - 4], 9
mov dword [ebp - 0x65c], 0
jmp 0x4282ff
mov edx, dword [ebp - 0x65c]
add edx, 1
mov dword [ebp - 0x65c], edx
cmp dword [ebp - 0x65c], 6
jge 0x428335
mov eax, dword [ebp - 0x65c]
and eax, 0x80000001
jns 0x42831a
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x42832a
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x428333
mov edx, dword [ebp - 0x1c]
sub edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x4282f0
mov dword [ebp - 4], 0xfffffffe
call fcn.00428343
jmp 0x428360
mov dword [ebp - 0x660], 0
jmp 0x42837b
mov edx, dword [ebp - 0x660]
add edx, 1
mov dword [ebp - 0x660], edx
cmp dword [ebp - 0x660], 0xe
jge 0x4283bc
cmp dword [ebp - 0x1c], 0
jge 0x428392
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4283a8
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x858]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x42836c
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x85c], 0
jmp 0x4283de
mov eax, dword [ebp - 0x85c]
add eax, 1
mov dword [ebp - 0x85c], eax
cmp dword [ebp - 0x85c], 0
jge 0x428425
mov eax, dword [ebp - 0x1c]
cdq
sub eax, edx
sar eax, 1
and eax, 0x80000001
jns 0x4283fb
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x42840b
mov ecx, dword [ebp - 0x1c]
and ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ecx
jmp 0x428423
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x428423
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x4283cf
mov dword [ebp - 4], 0xfffffffe
call fcn.00428433
jmp 0x428442
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x860], 0
jmp 0x428464
mov ecx, dword [ebp - 0x860]
add ecx, 1
mov dword [ebp - 0x860], ecx
cmp dword [ebp - 0x860], 0xb
jge 0x42849f
mov eax, dword [ebp - 0x860]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x428493
mov eax, dword [ebp - 0x860]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x42849a
and eax, 0xbc614e
jmp 0x42849d
mov dword [ebp - 0x1c], eax
jmp 0x428455
mov dword [ebp - 4], 0xfffffffe
call fcn.004284ad
jmp 0x4284b5
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x864], 0
jmp 0x4284d7
mov edx, dword [ebp - 0x864]
add edx, 1
mov dword [ebp - 0x864], edx
cmp dword [ebp - 0x864], 0xe
jge 0x428512
mov eax, dword [ebp - 0x864]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x428506
mov eax, dword [ebp - 0x864]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x42850d
and eax, 0xbc614e
jmp 0x428510
mov dword [ebp - 0x1c], eax
jmp 0x4284c8
mov dword [ebp - 4], 0xfffffffe
call fcn.00428520
jmp 0x428528
mov dword [ebp - 0x868], 1
mov dword [ebp - 0x86c], 1
mov dword [ebp - 0x870], 2
mov dword [ebp - 0x874], 0
mov dword [ebp - 0x878], 0
jmp 0x42856b
mov edx, dword [ebp - 0x878]
add edx, 1
mov dword [ebp - 0x878], edx
cmp dword [ebp - 0x878], 0
jge 0x4285ac
mov eax, dword [ebp - 0x868]
add eax, dword [ebp - 0x86c]
mov dword [ebp - 0x870], eax
mov ecx, dword [ebp - 0x86c]
mov dword [ebp - 0x868], ecx
mov edx, dword [ebp - 0x870]
mov dword [ebp - 0x86c], edx
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x870]
mov dword [ebp - 0x1c], eax
jmp 0x42855c
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x87c], 1
mov dword [ebp - 0x880], 1
mov dword [ebp - 0x884], 2
mov dword [ebp - 0x888], 0
mov dword [ebp - 0x88c], 0
jmp 0x4285f5
mov edx, dword [ebp - 0x88c]
add edx, 1
mov dword [ebp - 0x88c], edx
cmp dword [ebp - 0x88c], 1
jge 0x428636
mov eax, dword [ebp - 0x87c]
add eax, dword [ebp - 0x880]
mov dword [ebp - 0x884], eax
mov ecx, dword [ebp - 0x880]
mov dword [ebp - 0x87c], ecx
mov edx, dword [ebp - 0x884]
mov dword [ebp - 0x880], edx
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x884]
mov dword [ebp - 0x1c], eax
jmp 0x4285e6
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x890], 0
jmp 0x42865a
mov edx, dword [ebp - 0x890]
add edx, 1
mov dword [ebp - 0x890], edx
cmp dword [ebp - 0x890], 3
jge 0x428673
mov eax, dword [ebp - 0x890]
not eax
xor eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x42864b
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x428687
mov ecx, dword [ebp - 0x1c]
neg ecx
imul ecx, ecx, 0xfffffffd
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x42869d
mov dword [ebp - 0x1c], 0xb
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x894], 0
jmp 0x4286bf
mov edx, dword [ebp - 0x894]
add edx, 1
mov dword [ebp - 0x894], edx
cmp dword [ebp - 0x894], 2
jge 0x4286fe
mov eax, dword [ebp - 0x894]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x4286ee
mov eax, dword [ebp - 0x894]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x4286f9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1c], eax
jmp 0x4286fc
mov dword [ebp - 0x1c], eax
jmp 0x4286b0
mov dword [ebp - 4], 0xfffffffe
call fcn.0042870c
jmp 0x428714
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x898], 0
jmp 0x428736
mov edx, dword [ebp - 0x898]
add edx, 1
mov dword [ebp - 0x898], edx
cmp dword [ebp - 0x898], 8
jge 0x42876c
mov eax, dword [ebp - 0x898]
and eax, 0x80000001
jns 0x428751
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x428761
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x42876a
mov edx, dword [ebp - 0x1c]
sub edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x428727
mov dword [ebp - 4], 0xfffffffe
call fcn.0042877a
jmp 0x428797
mov dword [ebp - 0x89c], 0
jmp 0x4287b2
mov edx, dword [ebp - 0x89c]
add edx, 1
mov dword [ebp - 0x89c], edx
cmp dword [ebp - 0x89c], 2
jge 0x4287cb
mov eax, dword [ebp - 0x89c]
not eax
xor eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x4287a3
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4287df
mov ecx, dword [ebp - 0x1c]
neg ecx
imul ecx, ecx, 0xfffffffd
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4287f5
mov dword [ebp - 0x1c], 0xb
mov dword [ebp - 0x8a0], 1
mov dword [ebp - 0x8a4], 1
mov dword [ebp - 0x8a8], 2
mov dword [ebp - 0x8ac], 0
mov dword [ebp - 0x8b0], 0
jmp 0x428838
mov edx, dword [ebp - 0x8b0]
add edx, 1
mov dword [ebp - 0x8b0], edx
cmp dword [ebp - 0x8b0], 8
jge 0x428879
mov eax, dword [ebp - 0x8a0]
add eax, dword [ebp - 0x8a4]
mov dword [ebp - 0x8a8], eax
mov ecx, dword [ebp - 0x8a4]
mov dword [ebp - 0x8a0], ecx
mov edx, dword [ebp - 0x8a8]
mov dword [ebp - 0x8a4], edx
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x8a8]
mov dword [ebp - 0x1c], eax
jmp 0x428829
mov ecx, dword [ebp - 0x1c]
add ecx, 8
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x8b4], 0
jmp 0x4288a4
mov edx, dword [ebp - 0x8b4]
add edx, 1
mov dword [ebp - 0x8b4], edx
cmp dword [ebp - 0x8b4], 7
jge 0x4288e3
mov eax, dword [ebp - 0x8b4]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x4288d3
mov eax, dword [ebp - 0x8b4]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x4288de
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1c], eax
jmp 0x4288e1
mov dword [ebp - 0x1c], eax
jmp 0x428895
mov dword [ebp - 4], 0xfffffffe
call fcn.004288f1
jmp 0x4288f9
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x8b8], 0
jmp 0x42891b
mov edx, dword [ebp - 0x8b8]
add edx, 1
mov dword [ebp - 0x8b8], edx
cmp dword [ebp - 0x8b8], 4
jge 0x428956
mov eax, dword [ebp - 0x8b8]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x42894a
mov eax, dword [ebp - 0x8b8]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x428951
and eax, 0xbc614e
jmp 0x428954
mov dword [ebp - 0x1c], eax
jmp 0x42890c
mov dword [ebp - 4], 0xfffffffe
call fcn.00428964
jmp 0x42896c
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x8bc], 0
jmp 0x42898e
mov edx, dword [ebp - 0x8bc]
add edx, 1
mov dword [ebp - 0x8bc], edx
cmp dword [ebp - 0x8bc], 5
jge 0x4289c4
mov eax, dword [ebp - 0x8bc]
and eax, 0x80000001
jns 0x4289a9
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x4289b9
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4289c2
mov edx, dword [ebp - 0x1c]
sub edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x42897f
mov dword [ebp - 4], 0xfffffffe
call fcn.004289d2
jmp 0x4289ef
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x8c0], 0
jmp 0x428a11
mov edx, dword [ebp - 0x8c0]
add edx, 1
mov dword [ebp - 0x8c0], edx
cmp dword [ebp - 0x8c0], 0
jge 0x428a47
mov eax, dword [ebp - 0x8c0]
and eax, 0x80000001
jns 0x428a2c
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x428a3c
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x428a45
mov edx, dword [ebp - 0x1c]
sub edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x428a02
mov dword [ebp - 4], 0xfffffffe
call fcn.00428a55
jmp 0x428a72
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x8c4], 0
jmp 0x428a94
mov edx, dword [ebp - 0x8c4]
add edx, 1
mov dword [ebp - 0x8c4], edx
cmp dword [ebp - 0x8c4], 2
jge 0x428acf
mov eax, dword [ebp - 0x8c4]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x428ac3
mov eax, dword [ebp - 0x8c4]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x428aca
and eax, 0xbc614e
jmp 0x428acd
mov dword [ebp - 0x1c], eax
jmp 0x428a85
mov dword [ebp - 4], 0xfffffffe
call fcn.00428add
jmp 0x428ae5
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x8c8], 0
jmp 0x428b07
mov edx, dword [ebp - 0x8c8]
add edx, 1
mov dword [ebp - 0x8c8], edx
cmp dword [ebp - 0x8c8], 7
jge 0x428b3d
mov eax, dword [ebp - 0x8c8]
and eax, 0x80000001
jns 0x428b22
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x428b32
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x428b3b
mov edx, dword [ebp - 0x1c]
sub edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x428af8
mov dword [ebp - 4], 0xfffffffe
call fcn.00428b4b
jmp 0x428b68
mov dword [ebp - 0x8cc], 0
jmp 0x428b83
mov edx, dword [ebp - 0x8cc]
add edx, 1
mov dword [ebp - 0x8cc], edx
cmp dword [ebp - 0x8cc], 1
jge 0x428bc4
cmp dword [ebp - 0x1c], 0
jge 0x428b9a
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x428bb0
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0xac8]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x428b74
mov dword [ebp - 4], 0x15
mov dword [ebp - 0xacc], 0
jmp 0x428be6
mov eax, dword [ebp - 0xacc]
add eax, 1
mov dword [ebp - 0xacc], eax
cmp dword [ebp - 0xacc], 4
jge 0x428c21
mov eax, dword [ebp - 0xacc]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x428c15
mov eax, dword [ebp - 0xacc]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x428c1c
and eax, 0xbc614e
jmp 0x428c1f
mov dword [ebp - 0x1c], eax
jmp 0x428bd7
mov dword [ebp - 4], 0xfffffffe
call fcn.00428c2f
jmp 0x428c37
mov dword [ebp - 0xad0], 0
jmp 0x428c52
mov edx, dword [ebp - 0xad0]
add edx, 1
mov dword [ebp - 0xad0], edx
cmp dword [ebp - 0xad0], 0
jge 0x428c6b
mov eax, dword [ebp - 0xad0]
not eax
xor eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x428c43
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x428c7f
mov ecx, dword [ebp - 0x1c]
neg ecx
imul ecx, ecx, 0xfffffffd
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x428c95
mov dword [ebp - 0x1c], 0xb
mov dword [ebp - 4], 0x16
mov dword [ebp - 0xad4], 0
jmp 0x428cb7
mov edx, dword [ebp - 0xad4]
add edx, 1
mov dword [ebp - 0xad4], edx
cmp dword [ebp - 0xad4], 1
jge 0x428cf6
mov eax, dword [ebp - 0xad4]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x428ce6
mov eax, dword [ebp - 0xad4]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x428cf1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1c], eax
jmp 0x428cf4
mov dword [ebp - 0x1c], eax
jmp 0x428ca8
mov dword [ebp - 4], 0xfffffffe
call fcn.00428d04
jmp 0x428d0c
mov dword [ebp - 0xad8], 0
jmp 0x428d27
mov edx, dword [ebp - 0xad8]
add edx, 1
mov dword [ebp - 0xad8], edx
cmp dword [ebp - 0xad8], 6
jge 0x428d40
mov eax, dword [ebp - 0xad8]
not eax
xor eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x428d18
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x428d54
mov ecx, dword [ebp - 0x1c]
neg ecx
imul ecx, ecx, 0xfffffffd
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x428d6a
mov dword [ebp - 0x1c], 0xb
mov dword [ebp - 4], 0x17
mov dword [ebp - 0xadc], 0
jmp 0x428d8c
mov edx, dword [ebp - 0xadc]
add edx, 1
mov dword [ebp - 0xadc], edx
cmp dword [ebp - 0xadc], 3
jge 0x428dd3
mov eax, dword [ebp - 0x1c]
cdq
sub eax, edx
sar eax, 1
and eax, 0x80000001
jns 0x428da9
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x428db9
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x428dd1
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x428dd1
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x428d7d
mov dword [ebp - 4], 0xfffffffe
call fcn.00428de1
jmp 0x428df0
mov dword [ebp - 0xae0], 1
mov dword [ebp - 0xae4], 1
mov dword [ebp - 0xae8], 2
mov dword [ebp - 0xaec], 0
mov dword [ebp - 0xaf0], 0
jmp 0x428e33
mov ecx, dword [ebp - 0xaf0]
add ecx, 1
mov dword [ebp - 0xaf0], ecx
cmp dword [ebp - 0xaf0], 0
jge 0x428e74
mov edx, dword [ebp - 0xae0]
add edx, dword [ebp - 0xae4]
mov dword [ebp - 0xae8], edx
mov eax, dword [ebp - 0xae4]
mov dword [ebp - 0xae0], eax
mov ecx, dword [ebp - 0xae8]
mov dword [ebp - 0xae4], ecx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0xae8]
mov dword [ebp - 0x1c], edx
jmp 0x428e24
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0x18
mov dword [ebp - 0xaf4], 0
jmp 0x428e9c
mov ecx, dword [ebp - 0xaf4]
add ecx, 1
mov dword [ebp - 0xaf4], ecx
cmp dword [ebp - 0xaf4], 0
jge 0x428edb
mov eax, dword [ebp - 0xaf4]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x428ecb
mov eax, dword [ebp - 0xaf4]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x428ed6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1c], eax
jmp 0x428ed9
mov dword [ebp - 0x1c], eax
jmp 0x428e8d
mov dword [ebp - 4], 0xfffffffe
call fcn.00428ee9
jmp 0x428ef1
mov dword [ebp - 4], 0x19
mov dword [ebp - 0xaf8], 0
jmp 0x428f13
mov edx, dword [ebp - 0xaf8]
add edx, 1
mov dword [ebp - 0xaf8], edx
cmp dword [ebp - 0xaf8], 0
jge 0x428f52
mov eax, dword [ebp - 0xaf8]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x428f42
mov eax, dword [ebp - 0xaf8]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x428f4d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1c], eax
jmp 0x428f50
mov dword [ebp - 0x1c], eax
jmp 0x428f04
mov dword [ebp - 4], 0xfffffffe
call fcn.00428f60
jmp 0x428f68
mov dword [ebp - 0xafc], 1
mov dword [ebp - 0xb00], 1
mov dword [ebp - 0xb04], 2
mov dword [ebp - 0xb08], 0
mov dword [ebp - 0xb0c], 0
jmp 0x428fab
mov edx, dword [ebp - 0xb0c]
add edx, 1
mov dword [ebp - 0xb0c], edx
cmp dword [ebp - 0xb0c], 4
jge 0x428fec
mov eax, dword [ebp - 0xafc]
add eax, dword [ebp - 0xb00]
mov dword [ebp - 0xb04], eax
mov ecx, dword [ebp - 0xb00]
mov dword [ebp - 0xafc], ecx
mov edx, dword [ebp - 0xb04]
mov dword [ebp - 0xb00], edx
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0xb04]
mov dword [ebp - 0x1c], eax
jmp 0x428f9c
mov ecx, dword [ebp - 0x1c]
add ecx, 4
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0x1a
mov dword [ebp - 0xb10], 0
jmp 0x429017
cmp dword [ebp - 0xb10], 4
jge 0x429056
mov eax, dword [ebp - 0xb10]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x429046
mov eax, dword [ebp - 0xb10]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x429051
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1c], eax
jmp 0x429054
mov dword [ebp - 0x1c], eax
jmp 0x429008
mov dword [ebp - 4], 0xfffffffe
call fcn.00429064
jmp 0x42906c
mov dword [ebp - 4], 0x1b
mov dword [ebp - 0xb14], 0
jmp 0x42908e
cmp dword [ebp - 0xb14], 0
jge 0x4290c9