Function at 0x47d860
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4b7d60
push 0x40d810
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x196c
call fcn.004175a0
mov eax, dword [0x4bc534]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x24], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
jmp 0x47d8b6
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x26
jge 0x47d8f4
cmp dword [ebp - 0x1c], 0
jge 0x47d8ca
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x47d8e0
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x220]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x47d8ad
mov dword [ebp - 4], 0
mov dword [ebp - 0x224], 0
jmp 0x47d916
mov eax, dword [ebp - 0x224]
add eax, 1
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 1
jge 0x47d94d
mov ecx, dword [ebp - 0x224]
and ecx, 0x80000001
jns 0x47d932
dec ecx
or ecx, 0xfffffffe
inc ecx
cmp ecx, 1
jne 0x47d942
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x47d94b
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [ebp - 0x1c], eax
jmp 0x47d907
mov dword [ebp - 4], 0xfffffffe
call fcn.0047d95b
jmp 0x47d979
mov dword [ebp - 4], 1
mov dword [ebp - 0x228], 0
jmp 0x47d99b
mov eax, dword [ebp - 0x228]
add eax, 1
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 6
jge 0x47d9d2
mov ecx, dword [ebp - 0x228]
and ecx, 0x80000001
jns 0x47d9b7
dec ecx
or ecx, 0xfffffffe
inc ecx
cmp ecx, 1
jne 0x47d9c7
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x47d9d0
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [ebp - 0x1c], eax
jmp 0x47d98c
mov dword [ebp - 4], 0xfffffffe
call fcn.0047d9e0
jmp 0x47d9fe
mov dword [ebp - 0x22c], 1
mov dword [ebp - 0x230], 1
mov dword [ebp - 0x234], 2
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x23c], 0
jmp 0x47da41
mov eax, dword [ebp - 0x23c]
add eax, 1
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0x1a
jge 0x47da82
mov ecx, dword [ebp - 0x22c]
add ecx, dword [ebp - 0x230]
mov dword [ebp - 0x234], ecx
mov edx, dword [ebp - 0x230]
mov dword [ebp - 0x22c], edx
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0x230], eax
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x234]
mov dword [ebp - 0x1c], ecx
jmp 0x47da32
mov edx, dword [ebp - 0x1c]
add edx, 0x1a
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], 2
mov dword [ebp - 0x240], 0
jmp 0x47daad
mov eax, dword [ebp - 0x240]
add eax, 1
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0x20
jge 0x47daec
mov eax, dword [ebp - 0x240]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x47dadc
mov eax, dword [ebp - 0x240]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x47dae7
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1c], eax
jmp 0x47daea
mov dword [ebp - 0x1c], eax
jmp 0x47da9e
mov dword [ebp - 4], 0xfffffffe
call fcn.0047dafa
jmp 0x47db02
mov dword [ebp - 4], 3
mov dword [ebp - 0x244], 0
jmp 0x47db24
mov edx, dword [ebp - 0x244]
add edx, 1
mov dword [ebp - 0x244], edx
cmp dword [ebp - 0x244], 0xa
jge 0x47db5f
mov eax, dword [ebp - 0x244]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x47db53
mov eax, dword [ebp - 0x244]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x47db5a
and eax, 0xbc614e
jmp 0x47db5d
mov dword [ebp - 0x1c], eax
jmp 0x47db15
mov dword [ebp - 4], 0xfffffffe
call fcn.0047db6d
jmp 0x47db75
mov dword [ebp - 4], 4
mov dword [ebp - 0x248], 0
jmp 0x47db97
mov edx, dword [ebp - 0x248]
add edx, 1
mov dword [ebp - 0x248], edx
cmp dword [ebp - 0x248], 4
jge 0x47dbde
mov eax, dword [ebp - 0x1c]
cdq
sub eax, edx
sar eax, 1
and eax, 0x80000001
jns 0x47dbb4
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x47dbc4
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x47dbdc
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x47dbdc
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x47db88
mov dword [ebp - 4], 0xfffffffe
call fcn.0047dbec
jmp 0x47dbfb
mov dword [ebp - 4], 5
mov dword [ebp - 0x24c], 0
jmp 0x47dc1d
mov ecx, dword [ebp - 0x24c]
add ecx, 1
mov dword [ebp - 0x24c], ecx
cmp dword [ebp - 0x24c], 1
jge 0x47dc64
mov eax, dword [ebp - 0x1c]
cdq
sub eax, edx
sar eax, 1
and eax, 0x80000001
jns 0x47dc3a
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x47dc4a
mov edx, dword [ebp - 0x1c]
and edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x47dc62
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x47dc62
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x47dc0e
mov dword [ebp - 4], 0xfffffffe
call fcn.0047dc72
jmp 0x47dc81
mov dword [ebp - 4], 6
mov dword [ebp - 0x250], 0
jmp 0x47dca3
mov ecx, dword [ebp - 0x250]
add ecx, 1
mov dword [ebp - 0x250], ecx
cmp dword [ebp - 0x250], 6
jge 0x47dcda
mov edx, dword [ebp - 0x250]
and edx, 0x80000001
jns 0x47dcbf
dec edx
or edx, 0xfffffffe
inc edx
cmp edx, 1
jne 0x47dccf
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
jmp 0x47dcd8
mov ecx, dword [ebp - 0x1c]
sub ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x47dc94
mov dword [ebp - 4], 0xfffffffe
call fcn.0047dce8
jmp 0x47dd06
mov dword [ebp - 0x254], 1
mov dword [ebp - 0x258], 1
mov dword [ebp - 0x25c], 2
mov dword [ebp - 0x260], 0
mov dword [ebp - 0x264], 0
jmp 0x47dd49
mov ecx, dword [ebp - 0x264]
add ecx, 1
mov dword [ebp - 0x264], ecx
cmp dword [ebp - 0x264], 2
jge 0x47dd8a
mov edx, dword [ebp - 0x254]
add edx, dword [ebp - 0x258]
mov dword [ebp - 0x25c], edx
mov eax, dword [ebp - 0x258]
mov dword [ebp - 0x254], eax
mov ecx, dword [ebp - 0x25c]
mov dword [ebp - 0x258], ecx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x25c]
mov dword [ebp - 0x1c], edx
jmp 0x47dd3a
mov eax, dword [ebp - 0x1c]
add eax, 2
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 7
mov dword [ebp - 0x268], 0
jmp 0x47ddb5
mov ecx, dword [ebp - 0x268]
add ecx, 1
mov dword [ebp - 0x268], ecx
cmp dword [ebp - 0x268], 9
jge 0x47ddf0
mov eax, dword [ebp - 0x268]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x47dde4
mov eax, dword [ebp - 0x268]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x47ddeb
and eax, 0xbc614e
jmp 0x47ddee
mov dword [ebp - 0x1c], eax
jmp 0x47dda6
mov dword [ebp - 4], 0xfffffffe
call fcn.0047ddfe
jmp 0x47de06
mov dword [ebp - 4], 8
mov dword [ebp - 0x26c], 0
jmp 0x47de28
mov edx, dword [ebp - 0x26c]
add edx, 1
mov dword [ebp - 0x26c], edx
cmp dword [ebp - 0x26c], 0
jge 0x47de63
mov eax, dword [ebp - 0x26c]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x47de57
mov eax, dword [ebp - 0x26c]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x47de5e
and eax, 0xbc614e
jmp 0x47de61
mov dword [ebp - 0x1c], eax
jmp 0x47de19
mov dword [ebp - 4], 0xfffffffe
call fcn.0047de71
jmp 0x47de79
mov dword [ebp - 4], 9
mov dword [ebp - 0x270], 0
jmp 0x47de9b
mov edx, dword [ebp - 0x270]
add edx, 1
mov dword [ebp - 0x270], edx
cmp dword [ebp - 0x270], 0xc
jge 0x47deda
mov eax, dword [ebp - 0x270]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x47deca
mov eax, dword [ebp - 0x270]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x47ded5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1c], eax
jmp 0x47ded8
mov dword [ebp - 0x1c], eax
jmp 0x47de8c
mov dword [ebp - 4], 0xfffffffe
call fcn.0047dee8
jmp 0x47def0
mov dword [ebp - 0x274], 0
jmp 0x47df0b
mov edx, dword [ebp - 0x274]
add edx, 1
mov dword [ebp - 0x274], edx
cmp dword [ebp - 0x274], 0xb
jge 0x47df24
mov eax, dword [ebp - 0x274]
not eax
xor eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x47defc
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x47df38
mov ecx, dword [ebp - 0x1c]
neg ecx
imul ecx, ecx, 0xfffffffd
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x47df4e
mov dword [ebp - 0x1c], 0xb
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x278], 0
jmp 0x47df70
mov edx, dword [ebp - 0x278]
add edx, 1
mov dword [ebp - 0x278], edx
cmp dword [ebp - 0x278], 4
jge 0x47dfaf
mov eax, dword [ebp - 0x278]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x47df9f
mov eax, dword [ebp - 0x278]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x47dfaa
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1c], eax
jmp 0x47dfad
mov dword [ebp - 0x1c], eax
jmp 0x47df61
mov dword [ebp - 4], 0xfffffffe
call fcn.0047dfbd
jmp 0x47dfc5
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x27c], 0
jmp 0x47dfe7
mov edx, dword [ebp - 0x27c]
add edx, 1
mov dword [ebp - 0x27c], edx
cmp dword [ebp - 0x27c], 4
jge 0x47e02e
mov eax, dword [ebp - 0x1c]
cdq
sub eax, edx
sar eax, 1
and eax, 0x80000001
jns 0x47e004
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x47e014
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x47e02c
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x47e02c
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x47dfd8
mov dword [ebp - 4], 0xfffffffe
call fcn.0047e03c
jmp 0x47e04b
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x280], 0
jmp 0x47e06d
mov ecx, dword [ebp - 0x280]
add ecx, 1
mov dword [ebp - 0x280], ecx
cmp dword [ebp - 0x280], 5
jge 0x47e0a8
mov eax, dword [ebp - 0x280]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x47e09c
mov eax, dword [ebp - 0x280]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x47e0a3
and eax, 0xbc614e
jmp 0x47e0a6
mov dword [ebp - 0x1c], eax
jmp 0x47e05e
mov dword [ebp - 4], 0xfffffffe
call fcn.0047e0b6
jmp 0x47e0be
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x284], 0
jmp 0x47e0e0
mov edx, dword [ebp - 0x284]
add edx, 1
mov dword [ebp - 0x284], edx
cmp dword [ebp - 0x284], 0
jge 0x47e11b
mov eax, dword [ebp - 0x284]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x47e10f
mov eax, dword [ebp - 0x284]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x47e116
and eax, 0xbc614e
jmp 0x47e119
mov dword [ebp - 0x1c], eax
jmp 0x47e0d1
mov dword [ebp - 4], 0xfffffffe
call fcn.0047e129
jmp 0x47e131
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x288], 0
jmp 0x47e153
mov edx, dword [ebp - 0x288]
add edx, 1
mov dword [ebp - 0x288], edx
cmp dword [ebp - 0x288], 3
jge 0x47e189
mov eax, dword [ebp - 0x288]
and eax, 0x80000001
jns 0x47e16e
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x47e17e
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x47e187
mov edx, dword [ebp - 0x1c]
sub edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x47e144
mov dword [ebp - 4], 0xfffffffe
call fcn.0047e197
jmp 0x47e1b4
mov dword [ebp - 0x28c], 1
mov dword [ebp - 0x290], 1
mov dword [ebp - 0x294], 2
mov dword [ebp - 0x298], 0
mov dword [ebp - 0x29c], 0
jmp 0x47e1f7
mov edx, dword [ebp - 0x29c]
add edx, 1
mov dword [ebp - 0x29c], edx
cmp dword [ebp - 0x29c], 5
jge 0x47e238
mov eax, dword [ebp - 0x28c]
add eax, dword [ebp - 0x290]
mov dword [ebp - 0x294], eax
mov ecx, dword [ebp - 0x290]
mov dword [ebp - 0x28c], ecx
mov edx, dword [ebp - 0x294]
mov dword [ebp - 0x290], edx
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x294]
mov dword [ebp - 0x1c], eax
jmp 0x47e1e8
mov ecx, dword [ebp - 0x1c]
add ecx, 5
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x2a0], 0
jmp 0x47e263
mov edx, dword [ebp - 0x2a0]
add edx, 1
mov dword [ebp - 0x2a0], edx
cmp dword [ebp - 0x2a0], 7
jge 0x47e2a2
mov eax, dword [ebp - 0x2a0]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x47e292
mov eax, dword [ebp - 0x2a0]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x47e29d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1c], eax
jmp 0x47e2a0
mov dword [ebp - 0x1c], eax
jmp 0x47e254
mov dword [ebp - 4], 0xfffffffe
call fcn.0047e2b0
jmp 0x47e2b8
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x2a4], 0
jmp 0x47e2da
mov edx, dword [ebp - 0x2a4]
add edx, 1
mov dword [ebp - 0x2a4], edx
cmp dword [ebp - 0x2a4], 1
jge 0x47e315
mov eax, dword [ebp - 0x2a4]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x47e309
mov eax, dword [ebp - 0x2a4]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x47e310
and eax, 0xbc614e
jmp 0x47e313
mov dword [ebp - 0x1c], eax
jmp 0x47e2cb
mov dword [ebp - 4], 0xfffffffe
call fcn.0047e323
jmp 0x47e32b
mov dword [ebp - 0x2a8], 1
mov dword [ebp - 0x2ac], 1
mov dword [ebp - 0x2b0], 2
mov dword [ebp - 0x2b4], 0
mov dword [ebp - 0x2b8], 0
jmp 0x47e36e
mov edx, dword [ebp - 0x2b8]
add edx, 1
mov dword [ebp - 0x2b8], edx
cmp dword [ebp - 0x2b8], 3
jge 0x47e3af
mov eax, dword [ebp - 0x2a8]
add eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x2b0], eax
mov ecx, dword [ebp - 0x2ac]
mov dword [ebp - 0x2a8], ecx
mov edx, dword [ebp - 0x2b0]
mov dword [ebp - 0x2ac], edx
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x2b0]
mov dword [ebp - 0x1c], eax
jmp 0x47e35f
mov ecx, dword [ebp - 0x1c]
add ecx, 3
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x2bc], 0
jmp 0x47e3da
mov edx, dword [ebp - 0x2bc]
add edx, 1
mov dword [ebp - 0x2bc], edx
cmp dword [ebp - 0x2bc], 1
jge 0x47e421
mov eax, dword [ebp - 0x1c]
cdq
sub eax, edx
sar eax, 1
and eax, 0x80000001
jns 0x47e3f7
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x47e407
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x47e41f
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x47e41f
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x47e3cb
mov dword [ebp - 4], 0xfffffffe
call fcn.0047e42f
jmp 0x47e43e
mov dword [ebp - 0x2c0], 0
jmp 0x47e459
mov ecx, dword [ebp - 0x2c0]
add ecx, 1
mov dword [ebp - 0x2c0], ecx
cmp dword [ebp - 0x2c0], 6
jge 0x47e49a
cmp dword [ebp - 0x1c], 0
jge 0x47e470
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x47e486
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x4b8]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x47e44a
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x4bc], 0
jmp 0x47e4bc
mov eax, dword [ebp - 0x4bc]
add eax, 1
mov dword [ebp - 0x4bc], eax
cmp dword [ebp - 0x4bc], 1
jge 0x47e503
mov eax, dword [ebp - 0x1c]
cdq
sub eax, edx
sar eax, 1
and eax, 0x80000001
jns 0x47e4d9
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x47e4e9
mov ecx, dword [ebp - 0x1c]
and ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ecx
jmp 0x47e501
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x47e501
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x47e4ad
mov dword [ebp - 4], 0xfffffffe
call fcn.0047e511
jmp 0x47e520
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x4c0], 0
jmp 0x47e542
mov ecx, dword [ebp - 0x4c0]
add ecx, 1
mov dword [ebp - 0x4c0], ecx
cmp dword [ebp - 0x4c0], 1
jge 0x47e589
mov eax, dword [ebp - 0x1c]
cdq
sub eax, edx
sar eax, 1
and eax, 0x80000001
jns 0x47e55f
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x47e56f
mov edx, dword [ebp - 0x1c]
and edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x47e587
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x47e587
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x47e533
mov dword [ebp - 4], 0xfffffffe
call fcn.0047e597
jmp 0x47e5a6
mov dword [ebp - 0x4c4], 0
jmp 0x47e5c1
mov ecx, dword [ebp - 0x4c4]
add ecx, 1
mov dword [ebp - 0x4c4], ecx
cmp dword [ebp - 0x4c4], 6
jge 0x47e5da
mov edx, dword [ebp - 0x4c4]
not edx
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x47e5b2
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x47e5ee
mov eax, dword [ebp - 0x1c]
neg eax
imul eax, eax, 0xfffffffd
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x47e604
mov dword [ebp - 0x1c], 0xb
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x4c8], 0
jmp 0x47e626
mov edx, dword [ebp - 0x4c8]
add edx, 1
mov dword [ebp - 0x4c8], edx
cmp dword [ebp - 0x4c8], 5
jge 0x47e665
mov eax, dword [ebp - 0x4c8]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x47e655
mov eax, dword [ebp - 0x4c8]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x47e660
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1c], eax
jmp 0x47e663
mov dword [ebp - 0x1c], eax
jmp 0x47e617
mov dword [ebp - 4], 0xfffffffe
call fcn.0047e673
jmp 0x47e67b
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x4cc], 0
jmp 0x47e69d
mov edx, dword [ebp - 0x4cc]
add edx, 1
mov dword [ebp - 0x4cc], edx
cmp dword [ebp - 0x4cc], 1
jge 0x47e6d3
mov eax, dword [ebp - 0x4cc]
and eax, 0x80000001
jns 0x47e6b8
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x47e6c8
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x47e6d1
mov edx, dword [ebp - 0x1c]
sub edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x47e68e
mov dword [ebp - 4], 0xfffffffe
call fcn.0047e6e1
jmp 0x47e6fe
mov dword [ebp - 4], 0x16
mov dword [ebp - 0x4d0], 0
jmp 0x47e720
mov edx, dword [ebp - 0x4d0]
add edx, 1
mov dword [ebp - 0x4d0], edx
cmp dword [ebp - 0x4d0], 7
jge 0x47e767
mov eax, dword [ebp - 0x1c]
cdq
sub eax, edx
sar eax, 1
and eax, 0x80000001
jns 0x47e73d
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x47e74d
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x47e765
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x47e765
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x47e711
mov dword [ebp - 4], 0xfffffffe
call fcn.0047e775
jmp 0x47e784
mov dword [ebp - 0x4d4], 0
jmp 0x47e79f
mov ecx, dword [ebp - 0x4d4]
add ecx, 1
mov dword [ebp - 0x4d4], ecx
cmp dword [ebp - 0x4d4], 8
jge 0x47e7e0
cmp dword [ebp - 0x1c], 0
jge 0x47e7b6
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x47e7cc
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x6d0]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x47e790
mov dword [ebp - 4], 0x17
mov dword [ebp - 0x6d4], 0
jmp 0x47e802
mov eax, dword [ebp - 0x6d4]
add eax, 1
mov dword [ebp - 0x6d4], eax
cmp dword [ebp - 0x6d4], 2
jge 0x47e83d
mov eax, dword [ebp - 0x6d4]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x47e831
mov eax, dword [ebp - 0x6d4]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x47e838
and eax, 0xbc614e
jmp 0x47e83b
mov dword [ebp - 0x1c], eax
jmp 0x47e7f3
mov dword [ebp - 4], 0xfffffffe
call fcn.0047e84b
jmp 0x47e853
mov dword [ebp - 4], 0x18
mov dword [ebp - 0x6d8], 0
jmp 0x47e875
mov edx, dword [ebp - 0x6d8]
add edx, 1
mov dword [ebp - 0x6d8], edx
cmp dword [ebp - 0x6d8], 5
jge 0x47e8ab
mov eax, dword [ebp - 0x6d8]
and eax, 0x80000001
jns 0x47e890
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x47e8a0
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x47e8a9
mov edx, dword [ebp - 0x1c]
sub edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x47e866
mov dword [ebp - 4], 0xfffffffe
call fcn.0047e8b9
jmp 0x47e8d6
mov dword [ebp - 4], 0x19
mov dword [ebp - 0x6dc], 0
jmp 0x47e8f8
mov edx, dword [ebp - 0x6dc]
add edx, 1
mov dword [ebp - 0x6dc], edx
cmp dword [ebp - 0x6dc], 6
jge 0x47e93f
mov eax, dword [ebp - 0x1c]
cdq
sub eax, edx
sar eax, 1
and eax, 0x80000001
jns 0x47e915
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x47e925
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x47e93d
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x47e93d
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x47e8e9
mov dword [ebp - 4], 0xfffffffe
call fcn.0047e94d
jmp 0x47e95c
mov dword [ebp - 4], 0x1a
mov dword [ebp - 0x6e0], 0
jmp 0x47e97e
mov ecx, dword [ebp - 0x6e0]
add ecx, 1
mov dword [ebp - 0x6e0], ecx
cmp dword [ebp - 0x6e0], 0
jge 0x47e9b9
mov eax, dword [ebp - 0x6e0]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x47e9ad
mov eax, dword [ebp - 0x6e0]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x47e9b4
and eax, 0xbc614e
jmp 0x47e9b7
mov dword [ebp - 0x1c], eax
jmp 0x47e96f
mov dword [ebp - 4], 0xfffffffe
call fcn.0047e9c7
jmp 0x47e9cf
mov dword [ebp - 0x6e4], 0
jmp 0x47e9ea
mov edx, dword [ebp - 0x6e4]
add edx, 1
mov dword [ebp - 0x6e4], edx
cmp dword [ebp - 0x6e4], 6
jge 0x47ea03
mov eax, dword [ebp - 0x6e4]
not eax
xor eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x47e9db
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x47ea17
mov ecx, dword [ebp - 0x1c]
neg ecx
imul ecx, ecx, 0xfffffffd
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x47ea2d
mov dword [ebp - 0x1c], 0xb
mov dword [ebp - 0x6e8], 0
jmp 0x47ea48
mov edx, dword [ebp - 0x6e8]
add edx, 1
mov dword [ebp - 0x6e8], edx
cmp dword [ebp - 0x6e8], 1
jge 0x47ea89
cmp dword [ebp - 0x1c], 0
jge 0x47ea5f
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x47ea75
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x8e0]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x47ea39
mov dword [ebp - 0x8e4], 1
mov dword [ebp - 0x8e8], 1
mov dword [ebp - 0x8ec], 2
mov dword [ebp - 0x8f0], 0
mov dword [ebp - 0x8f4], 0
jmp 0x47eacc
mov eax, dword [ebp - 0x8f4]
add eax, 1
mov dword [ebp - 0x8f4], eax
cmp dword [ebp - 0x8f4], 2
jge 0x47eb0d
mov ecx, dword [ebp - 0x8e4]
add ecx, dword [ebp - 0x8e8]
mov dword [ebp - 0x8ec], ecx
mov edx, dword [ebp - 0x8e8]
mov dword [ebp - 0x8e4], edx
mov eax, dword [ebp - 0x8ec]
mov dword [ebp - 0x8e8], eax
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x8ec]
mov dword [ebp - 0x1c], ecx
jmp 0x47eabd
mov edx, dword [ebp - 0x1c]
add edx, 2
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], 0x1b
mov dword [ebp - 0x8f8], 0
jmp 0x47eb38
mov eax, dword [ebp - 0x8f8]
add eax, 1
mov dword [ebp - 0x8f8], eax
cmp dword [ebp - 0x8f8], 6
jge 0x47eb73
mov eax, dword [ebp - 0x8f8]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x47eb67
mov eax, dword [ebp - 0x8f8]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x47eb6e
and eax, 0xbc614e
jmp 0x47eb71
mov dword [ebp - 0x1c], eax
jmp 0x47eb29
mov dword [ebp - 4], 0xfffffffe
call fcn.0047eb81
jmp 0x47eb89
mov dword [ebp - 4], 0x1c
mov dword [ebp - 0x8fc], 0
jmp 0x47ebab
mov edx, dword [ebp - 0x8fc]
add edx, 1
mov dword [ebp - 0x8fc], edx
cmp dword [ebp - 0x8fc], 3
jge 0x47ebf2
mov eax, dword [ebp - 0x1c]
cdq
sub eax, edx
sar eax, 1
and eax, 0x80000001
jns 0x47ebc8
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x47ebd8
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x47ebf0
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x47ebf0
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x47eb9c
mov dword [ebp - 4], 0xfffffffe
call fcn.0047ec00
jmp 0x47ec0f
mov dword [ebp - 0x900], 0
jmp 0x47ec2a
mov ecx, dword [ebp - 0x900]
add ecx, 1
mov dword [ebp - 0x900], ecx
cmp dword [ebp - 0x900], 2
jge 0x47ec6b
cmp dword [ebp - 0x1c], 0
jge 0x47ec41
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x47ec57
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0xaf8]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x47ec1b
mov dword [ebp - 0xafc], 1
mov dword [ebp - 0xb00], 1
mov dword [ebp - 0xb04], 2
mov dword [ebp - 0xb08], 0
mov dword [ebp - 0xb0c], 0
jmp 0x47ecae
mov eax, dword [ebp - 0xb0c]
add eax, 1
mov dword [ebp - 0xb0c], eax
cmp dword [ebp - 0xb0c], 7
jge 0x47ecef
mov ecx, dword [ebp - 0xafc]
add ecx, dword [ebp - 0xb00]
mov dword [ebp - 0xb04], ecx
mov edx, dword [ebp - 0xb00]
mov dword [ebp - 0xafc], edx
mov eax, dword [ebp - 0xb04]
mov dword [ebp - 0xb00], eax
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0xb04]
mov dword [ebp - 0x1c], ecx
jmp 0x47ec9f
mov edx, dword [ebp - 0x1c]
add edx, 7
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], 0x1d
mov dword [ebp - 0xb10], 0
jmp 0x47ed1a
mov eax, dword [ebp - 0xb10]
add eax, 1
mov dword [ebp - 0xb10], eax
cmp dword [ebp - 0xb10], 3
jge 0x47ed61
mov eax, dword [ebp - 0x1c]
cdq
sub eax, edx
sar eax, 1
and eax, 0x80000001
jns 0x47ed37
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x47ed47
mov ecx, dword [ebp - 0x1c]
and ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ecx
jmp 0x47ed5f
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x47ed5f
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x47ed0b
mov dword [ebp - 4], 0xfffffffe
call fcn.0047ed6f
jmp 0x47ed7e
mov dword [ebp - 4], 0x1e
mov dword [ebp - 0xb14], 0
jmp 0x47eda0
cmp dword [ebp - 0xb14], 8
jge 0x47edd7
mov edx, dword [ebp - 0xb14]
and edx, 0x80000001
jns 0x47edbc
dec edx
or edx, 0xfffffffe
inc edx
cmp edx, 1
jne 0x47edcc
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
jmp 0x47edd5
mov ecx, dword [ebp - 0x1c]
sub ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x47ed91
mov dword [ebp - 4], 0xfffffffe
call fcn.0047ede5
jmp 0x47ee03
mov dword [ebp - 0xb18], 0
jmp 0x47ee1e
cmp dword [ebp - 0xb18], 3
jge 0x47ee37