Function at 0x49cd00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4b9c88
push 0x40d810
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x1138
call fcn.004175a0
mov eax, dword [0x4bc534]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x5c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 0
jmp 0x49cd5d
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x49cd8f
mov eax, dword [ebp - 0x20]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x49cd83
mov eax, dword [ebp - 0x20]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x49cd8a
and eax, 0xbc614e
jmp 0x49cd8d
mov dword [ebp - 0x1c], eax
jmp 0x49cd54
mov dword [ebp - 4], 0xfffffffe
call fcn.0049cd9d
jmp 0x49cda5
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x2c], 2
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
jmp 0x49cdd3
mov edx, dword [ebp - 0x34]
add edx, 1
mov dword [ebp - 0x34], edx
cmp dword [ebp - 0x34], 0x30
jge 0x49cdf9
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
jmp 0x49cdca
mov ecx, dword [ebp - 0x1c]
add ecx, 0x30
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 1
mov dword [ebp - 0x38], 0
jmp 0x49ce1b
mov edx, dword [ebp - 0x38]
add edx, 1
mov dword [ebp - 0x38], edx
cmp dword [ebp - 0x38], 6
jge 0x49ce5f
mov eax, dword [ebp - 0x1c]
cdq
sub eax, edx
sar eax, 1
and eax, 0x80000001
jns 0x49ce35
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x49ce45
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x49ce5d
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x49ce5d
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x49ce12
mov dword [ebp - 4], 0xfffffffe
call fcn.0049ce6d
jmp 0x49ce7c
mov dword [ebp - 4], 2
mov dword [ebp - 0x3c], 0
jmp 0x49ce95
mov ecx, dword [ebp - 0x3c]
add ecx, 1
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x3c], 0x16
jge 0x49cec6
mov edx, dword [ebp - 0x3c]
and edx, 0x80000001
jns 0x49ceab
dec edx
or edx, 0xfffffffe
inc edx
cmp edx, 1
jne 0x49cebb
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
jmp 0x49cec4
mov ecx, dword [ebp - 0x1c]
sub ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x49ce8c
mov dword [ebp - 4], 0xfffffffe
call fcn.0049ced4
jmp 0x49cef2
mov dword [ebp - 4], 3
mov dword [ebp - 0x40], 0
jmp 0x49cf0b
mov ecx, dword [ebp - 0x40]
add ecx, 1
mov dword [ebp - 0x40], ecx
cmp dword [ebp - 0x40], 3
jge 0x49cf4f
mov eax, dword [ebp - 0x1c]
cdq
sub eax, edx
sar eax, 1
and eax, 0x80000001
jns 0x49cf25
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x49cf35
mov edx, dword [ebp - 0x1c]
and edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x49cf4d
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x49cf4d
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x49cf02
mov dword [ebp - 4], 0xfffffffe
call fcn.0049cf5d
jmp 0x49cf6c
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x4c], 2
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x54], 0
jmp 0x49cf9a
mov ecx, dword [ebp - 0x54]
add ecx, 1
mov dword [ebp - 0x54], ecx
cmp dword [ebp - 0x54], 7
jge 0x49cfc0
mov edx, dword [ebp - 0x44]
add edx, dword [ebp - 0x48]
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x48], ecx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x4c]
mov dword [ebp - 0x1c], edx
jmp 0x49cf91
mov eax, dword [ebp - 0x1c]
add eax, 7
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x58], 0
jmp 0x49cfdb
mov ecx, dword [ebp - 0x58]
add ecx, 1
mov dword [ebp - 0x58], ecx
cmp dword [ebp - 0x58], 0
jge 0x49d019
cmp dword [ebp - 0x1c], 0
jge 0x49cfef
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x49d005
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x258]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x49cfd2
mov dword [ebp - 4], 4
mov dword [ebp - 0x25c], 0
jmp 0x49d03b
mov eax, dword [ebp - 0x25c]
add eax, 1
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0x10
jge 0x49d07a
mov eax, dword [ebp - 0x25c]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x49d06a
mov eax, dword [ebp - 0x25c]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x49d075
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1c], eax
jmp 0x49d078
mov dword [ebp - 0x1c], eax
jmp 0x49d02c
mov dword [ebp - 4], 0xfffffffe
call fcn.0049d088
jmp 0x49d090
mov dword [ebp - 4], 5
mov dword [ebp - 0x260], 0
jmp 0x49d0b2
mov edx, dword [ebp - 0x260]
add edx, 1
mov dword [ebp - 0x260], edx
cmp dword [ebp - 0x260], 0xb
jge 0x49d0ed
mov eax, dword [ebp - 0x260]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x49d0e1
mov eax, dword [ebp - 0x260]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x49d0e8
and eax, 0xbc614e
jmp 0x49d0eb
mov dword [ebp - 0x1c], eax
jmp 0x49d0a3
mov dword [ebp - 4], 0xfffffffe
call fcn.0049d0fb
jmp 0x49d103
mov dword [ebp - 4], 6
mov dword [ebp - 0x264], 0
jmp 0x49d125
mov edx, dword [ebp - 0x264]
add edx, 1
mov dword [ebp - 0x264], edx
cmp dword [ebp - 0x264], 8
jge 0x49d16c
mov eax, dword [ebp - 0x1c]
cdq
sub eax, edx
sar eax, 1
and eax, 0x80000001
jns 0x49d142
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x49d152
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x49d16a
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x49d16a
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x49d116
mov dword [ebp - 4], 0xfffffffe
call fcn.0049d17a
jmp 0x49d189
mov dword [ebp - 4], 7
mov dword [ebp - 0x268], 0
jmp 0x49d1ab
mov ecx, dword [ebp - 0x268]
add ecx, 1
mov dword [ebp - 0x268], ecx
cmp dword [ebp - 0x268], 4
jge 0x49d1e6
mov eax, dword [ebp - 0x268]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x49d1da
mov eax, dword [ebp - 0x268]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x49d1e1
and eax, 0xbc614e
jmp 0x49d1e4
mov dword [ebp - 0x1c], eax
jmp 0x49d19c
mov dword [ebp - 4], 0xfffffffe
call fcn.0049d1f4
jmp 0x49d1fc
mov dword [ebp - 4], 8
mov dword [ebp - 0x26c], 0
jmp 0x49d21e
mov edx, dword [ebp - 0x26c]
add edx, 1
mov dword [ebp - 0x26c], edx
cmp dword [ebp - 0x26c], 8
jge 0x49d25d
mov eax, dword [ebp - 0x26c]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x49d24d
mov eax, dword [ebp - 0x26c]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x49d258
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1c], eax
jmp 0x49d25b
mov dword [ebp - 0x1c], eax
jmp 0x49d20f
mov dword [ebp - 4], 0xfffffffe
call fcn.0049d26b
jmp 0x49d273
mov dword [ebp - 0x270], 0
jmp 0x49d28e
mov edx, dword [ebp - 0x270]
add edx, 1
mov dword [ebp - 0x270], edx
cmp dword [ebp - 0x270], 7
jge 0x49d2cf
cmp dword [ebp - 0x1c], 0
jge 0x49d2a5
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x49d2bb
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x468]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x49d27f
mov dword [ebp - 0x46c], 1
mov dword [ebp - 0x470], 1
mov dword [ebp - 0x474], 2
mov dword [ebp - 0x478], 0
mov dword [ebp - 0x47c], 0
jmp 0x49d312
mov eax, dword [ebp - 0x47c]
add eax, 1
mov dword [ebp - 0x47c], eax
cmp dword [ebp - 0x47c], 0xf
jge 0x49d353
mov ecx, dword [ebp - 0x46c]
add ecx, dword [ebp - 0x470]
mov dword [ebp - 0x474], ecx
mov edx, dword [ebp - 0x470]
mov dword [ebp - 0x46c], edx
mov eax, dword [ebp - 0x474]
mov dword [ebp - 0x470], eax
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x474]
mov dword [ebp - 0x1c], ecx
jmp 0x49d303
mov edx, dword [ebp - 0x1c]
add edx, 0xf
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x480], 0
jmp 0x49d377
mov eax, dword [ebp - 0x480]
add eax, 1
mov dword [ebp - 0x480], eax
cmp dword [ebp - 0x480], 0x10
jge 0x49d3b8
cmp dword [ebp - 0x1c], 0
jge 0x49d38e
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x49d3a4
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x678]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x49d368
mov dword [ebp - 0x67c], 1
mov dword [ebp - 0x680], 1
mov dword [ebp - 0x684], 2
mov dword [ebp - 0x688], 0
mov dword [ebp - 0x68c], 0
jmp 0x49d3fb
mov eax, dword [ebp - 0x68c]
add eax, 1
mov dword [ebp - 0x68c], eax
cmp dword [ebp - 0x68c], 7
jge 0x49d43c
mov ecx, dword [ebp - 0x67c]
add ecx, dword [ebp - 0x680]
mov dword [ebp - 0x684], ecx
mov edx, dword [ebp - 0x680]
mov dword [ebp - 0x67c], edx
mov eax, dword [ebp - 0x684]
mov dword [ebp - 0x680], eax
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x684]
mov dword [ebp - 0x1c], ecx
jmp 0x49d3ec
mov edx, dword [ebp - 0x1c]
add edx, 7
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], 9
mov dword [ebp - 0x690], 0
jmp 0x49d467
mov eax, dword [ebp - 0x690]
add eax, 1
mov dword [ebp - 0x690], eax
cmp dword [ebp - 0x690], 0xb
jge 0x49d49e
mov ecx, dword [ebp - 0x690]
and ecx, 0x80000001
jns 0x49d483
dec ecx
or ecx, 0xfffffffe
inc ecx
cmp ecx, 1
jne 0x49d493
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x49d49c
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [ebp - 0x1c], eax
jmp 0x49d458
mov dword [ebp - 4], 0xfffffffe
call fcn.0049d4ac
jmp 0x49d4ca
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x694], 0
jmp 0x49d4ec
mov eax, dword [ebp - 0x694]
add eax, 1
mov dword [ebp - 0x694], eax
cmp dword [ebp - 0x694], 0xd
jge 0x49d52b
mov eax, dword [ebp - 0x694]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x49d51b
mov eax, dword [ebp - 0x694]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x49d526
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1c], eax
jmp 0x49d529
mov dword [ebp - 0x1c], eax
jmp 0x49d4dd
mov dword [ebp - 4], 0xfffffffe
call fcn.0049d539
jmp 0x49d541
mov dword [ebp - 0x698], 0
jmp 0x49d55c
mov edx, dword [ebp - 0x698]
add edx, 1
mov dword [ebp - 0x698], edx
cmp dword [ebp - 0x698], 1
jge 0x49d59d
cmp dword [ebp - 0x1c], 0
jge 0x49d573
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x49d589
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x890]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x49d54d
mov dword [ebp - 0x894], 0
jmp 0x49d5b8
mov eax, dword [ebp - 0x894]
add eax, 1
mov dword [ebp - 0x894], eax
cmp dword [ebp - 0x894], 0xa
jge 0x49d5f9
cmp dword [ebp - 0x1c], 0
jge 0x49d5cf
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x49d5e5
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0xa90]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x49d5a9
mov dword [ebp - 4], 0xb
mov dword [ebp - 0xa94], 0
jmp 0x49d61b
mov eax, dword [ebp - 0xa94]
add eax, 1
mov dword [ebp - 0xa94], eax
cmp dword [ebp - 0xa94], 0
jge 0x49d652
mov ecx, dword [ebp - 0xa94]
and ecx, 0x80000001
jns 0x49d637
dec ecx
or ecx, 0xfffffffe
inc ecx
cmp ecx, 1
jne 0x49d647
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x49d650
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [ebp - 0x1c], eax
jmp 0x49d60c
mov dword [ebp - 4], 0xfffffffe
call fcn.0049d660
jmp 0x49d67e
mov dword [ebp - 0xa98], 1
mov dword [ebp - 0xa9c], 1
mov dword [ebp - 0xaa0], 2
mov dword [ebp - 0xaa4], 0
mov dword [ebp - 0xaa8], 0
jmp 0x49d6c1
mov eax, dword [ebp - 0xaa8]
add eax, 1
mov dword [ebp - 0xaa8], eax
cmp dword [ebp - 0xaa8], 8
jge 0x49d702
mov ecx, dword [ebp - 0xa98]
add ecx, dword [ebp - 0xa9c]
mov dword [ebp - 0xaa0], ecx
mov edx, dword [ebp - 0xa9c]
mov dword [ebp - 0xa98], edx
mov eax, dword [ebp - 0xaa0]
mov dword [ebp - 0xa9c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0xaa0]
mov dword [ebp - 0x1c], ecx
jmp 0x49d6b2
mov edx, dword [ebp - 0x1c]
add edx, 8
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0xaac], 0
jmp 0x49d726
mov eax, dword [ebp - 0xaac]
add eax, 1
mov dword [ebp - 0xaac], eax
cmp dword [ebp - 0xaac], 8
jge 0x49d73f
mov ecx, dword [ebp - 0xaac]
not ecx
xor ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ecx
jmp 0x49d717
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x49d753
mov edx, dword [ebp - 0x1c]
neg edx
imul edx, edx, 0xfffffffd
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x49d769
mov dword [ebp - 0x1c], 0xb
mov dword [ebp - 4], 0xc
mov dword [ebp - 0xab0], 0
jmp 0x49d78b
mov edx, dword [ebp - 0xab0]
add edx, 1
mov dword [ebp - 0xab0], edx
cmp dword [ebp - 0xab0], 8
jge 0x49d7c6
mov eax, dword [ebp - 0xab0]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x49d7ba
mov eax, dword [ebp - 0xab0]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x49d7c1
and eax, 0xbc614e
jmp 0x49d7c4
mov dword [ebp - 0x1c], eax
jmp 0x49d77c
mov dword [ebp - 4], 0xfffffffe
call fcn.0049d7d4
jmp 0x49d7dc
mov dword [ebp - 4], 0xd
mov dword [ebp - 0xab4], 0
jmp 0x49d7fe
mov edx, dword [ebp - 0xab4]
add edx, 1
mov dword [ebp - 0xab4], edx
cmp dword [ebp - 0xab4], 4
jge 0x49d839
mov eax, dword [ebp - 0xab4]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x49d82d
mov eax, dword [ebp - 0xab4]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x49d834
and eax, 0xbc614e
jmp 0x49d837
mov dword [ebp - 0x1c], eax
jmp 0x49d7ef
mov dword [ebp - 4], 0xfffffffe
call fcn.0049d847
jmp 0x49d84f
mov dword [ebp - 4], 0xe
mov dword [ebp - 0xab8], 0
jmp 0x49d871
mov edx, dword [ebp - 0xab8]
add edx, 1
mov dword [ebp - 0xab8], edx
cmp dword [ebp - 0xab8], 2
jge 0x49d8b8
mov eax, dword [ebp - 0x1c]
cdq
sub eax, edx
sar eax, 1
and eax, 0x80000001
jns 0x49d88e
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x49d89e
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x49d8b6
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x49d8b6
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x49d862
mov dword [ebp - 4], 0xfffffffe
call fcn.0049d8c6
jmp 0x49d8d5
mov dword [ebp - 0xabc], 1
mov dword [ebp - 0xac0], 1
mov dword [ebp - 0xac4], 2
mov dword [ebp - 0xac8], 0
mov dword [ebp - 0xacc], 0
jmp 0x49d918
mov ecx, dword [ebp - 0xacc]
add ecx, 1
mov dword [ebp - 0xacc], ecx
cmp dword [ebp - 0xacc], 2
jge 0x49d959
mov edx, dword [ebp - 0xabc]
add edx, dword [ebp - 0xac0]
mov dword [ebp - 0xac4], edx
mov eax, dword [ebp - 0xac0]
mov dword [ebp - 0xabc], eax
mov ecx, dword [ebp - 0xac4]
mov dword [ebp - 0xac0], ecx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0xac4]
mov dword [ebp - 0x1c], edx
jmp 0x49d909
mov eax, dword [ebp - 0x1c]
add eax, 2
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xf
mov dword [ebp - 0xad0], 0
jmp 0x49d984
mov ecx, dword [ebp - 0xad0]
add ecx, 1
mov dword [ebp - 0xad0], ecx
cmp dword [ebp - 0xad0], 0
jge 0x49d9cb
mov eax, dword [ebp - 0x1c]
cdq
sub eax, edx
sar eax, 1
and eax, 0x80000001
jns 0x49d9a1
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x49d9b1
mov edx, dword [ebp - 0x1c]
and edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x49d9c9
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x49d9c9
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x49d975
mov dword [ebp - 4], 0xfffffffe
call fcn.0049d9d9
jmp 0x49d9e8
mov dword [ebp - 4], 0x10
mov dword [ebp - 0xad4], 0
jmp 0x49da0a
mov ecx, dword [ebp - 0xad4]
add ecx, 1
mov dword [ebp - 0xad4], ecx
cmp dword [ebp - 0xad4], 1
jge 0x49da41
mov edx, dword [ebp - 0xad4]
and edx, 0x80000001
jns 0x49da26
dec edx
or edx, 0xfffffffe
inc edx
cmp edx, 1
jne 0x49da36
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
jmp 0x49da3f
mov ecx, dword [ebp - 0x1c]
sub ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x49d9fb
mov dword [ebp - 4], 0xfffffffe
call fcn.0049da4f
jmp 0x49da6d
mov dword [ebp - 4], 0x11
mov dword [ebp - 0xad8], 0
jmp 0x49da8f
mov ecx, dword [ebp - 0xad8]
add ecx, 1
mov dword [ebp - 0xad8], ecx
cmp dword [ebp - 0xad8], 0
jge 0x49dace
mov eax, dword [ebp - 0xad8]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x49dabe
mov eax, dword [ebp - 0xad8]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x49dac9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1c], eax
jmp 0x49dacc
mov dword [ebp - 0x1c], eax
jmp 0x49da80
mov dword [ebp - 4], 0xfffffffe
call fcn.0049dadc
jmp 0x49dae4
mov dword [ebp - 4], 0x12
mov dword [ebp - 0xadc], 0
jmp 0x49db06
mov edx, dword [ebp - 0xadc]
add edx, 1
mov dword [ebp - 0xadc], edx
cmp dword [ebp - 0xadc], 2
jge 0x49db4d
mov eax, dword [ebp - 0x1c]
cdq
sub eax, edx
sar eax, 1
and eax, 0x80000001
jns 0x49db23
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x49db33
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x49db4b
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x49db4b
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x49daf7
mov dword [ebp - 4], 0xfffffffe
call fcn.0049db5b
jmp 0x49db6a
mov dword [ebp - 0xae0], 1
mov dword [ebp - 0xae4], 1
mov dword [ebp - 0xae8], 2
mov dword [ebp - 0xaec], 0
mov dword [ebp - 0xaf0], 0
jmp 0x49dbad
mov ecx, dword [ebp - 0xaf0]
add ecx, 1
mov dword [ebp - 0xaf0], ecx
cmp dword [ebp - 0xaf0], 4
jge 0x49dbee
mov edx, dword [ebp - 0xae0]
add edx, dword [ebp - 0xae4]
mov dword [ebp - 0xae8], edx
mov eax, dword [ebp - 0xae4]
mov dword [ebp - 0xae0], eax
mov ecx, dword [ebp - 0xae8]
mov dword [ebp - 0xae4], ecx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0xae8]
mov dword [ebp - 0x1c], edx
jmp 0x49db9e
mov eax, dword [ebp - 0x1c]
add eax, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0x13
mov dword [ebp - 0xaf4], 0
jmp 0x49dc19
mov ecx, dword [ebp - 0xaf4]
add ecx, 1
mov dword [ebp - 0xaf4], ecx
cmp dword [ebp - 0xaf4], 3
jge 0x49dc50
mov edx, dword [ebp - 0xaf4]
and edx, 0x80000001
jns 0x49dc35
dec edx
or edx, 0xfffffffe
inc edx
cmp edx, 1
jne 0x49dc45
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
jmp 0x49dc4e
mov ecx, dword [ebp - 0x1c]
sub ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x49dc0a
mov dword [ebp - 4], 0xfffffffe
call fcn.0049dc5e
jmp 0x49dc7c
mov dword [ebp - 4], 0x14
mov dword [ebp - 0xaf8], 0
jmp 0x49dc9e
mov ecx, dword [ebp - 0xaf8]
add ecx, 1
mov dword [ebp - 0xaf8], ecx
cmp dword [ebp - 0xaf8], 0
jge 0x49dce5
mov eax, dword [ebp - 0x1c]
cdq
sub eax, edx
sar eax, 1
and eax, 0x80000001
jns 0x49dcbb
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x49dccb
mov edx, dword [ebp - 0x1c]
and edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x49dce3
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x49dce3
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x49dc8f
mov dword [ebp - 4], 0xfffffffe
call fcn.0049dcf3
jmp 0x49dd02
mov dword [ebp - 0xafc], 1
mov dword [ebp - 0xb00], 1
mov dword [ebp - 0xb04], 2
mov dword [ebp - 0xb08], 0
mov dword [ebp - 0xb0c], 0
jmp 0x49dd45
mov ecx, dword [ebp - 0xb0c]
add ecx, 1
mov dword [ebp - 0xb0c], ecx
cmp dword [ebp - 0xb0c], 0
jge 0x49dd86
mov edx, dword [ebp - 0xafc]
add edx, dword [ebp - 0xb00]
mov dword [ebp - 0xb04], edx
mov eax, dword [ebp - 0xb00]
mov dword [ebp - 0xafc], eax
mov ecx, dword [ebp - 0xb04]
mov dword [ebp - 0xb00], ecx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0xb04]
mov dword [ebp - 0x1c], edx
jmp 0x49dd36
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0x15
mov dword [ebp - 0xb10], 0
jmp 0x49ddae
mov ecx, dword [ebp - 0xb10]
add ecx, 1
mov dword [ebp - 0xb10], ecx
cmp dword [ebp - 0xb10], 1
jge 0x49ddf5
mov eax, dword [ebp - 0x1c]
cdq
sub eax, edx
sar eax, 1
and eax, 0x80000001
jns 0x49ddcb
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x49dddb
mov edx, dword [ebp - 0x1c]
and edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x49ddf3
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x49ddf3
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x49dd9f
mov dword [ebp - 4], 0xfffffffe
call fcn.0049de03
jmp 0x49de12
mov dword [ebp - 0xb14], 0
jmp 0x49de2d
mov ecx, dword [ebp - 0xb14]
add ecx, 1
mov dword [ebp - 0xb14], ecx
cmp dword [ebp - 0xb14], 4
jge 0x49de46
mov edx, dword [ebp - 0xb14]
not edx
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x49de1e
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x49de5a
mov eax, dword [ebp - 0x1c]
neg eax
imul eax, eax, 0xfffffffd
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x49de70
mov dword [ebp - 0x1c], 0xb
mov dword [ebp - 0xb18], 0
jmp 0x49de8b
mov edx, dword [ebp - 0xb18]
add edx, 1
mov dword [ebp - 0xb18], edx
cmp dword [ebp - 0xb18], 4
jge 0x49decc
cmp dword [ebp - 0x1c], 0
jge 0x49dea2
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x49deb8
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0xd10]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x49de7c
mov dword [ebp - 4], 0x16
mov dword [ebp - 0xd14], 0
jmp 0x49deee
mov eax, dword [ebp - 0xd14]
add eax, 1
mov dword [ebp - 0xd14], eax
cmp dword [ebp - 0xd14], 2
jge 0x49df2d
mov eax, dword [ebp - 0xd14]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x49df1d
mov eax, dword [ebp - 0xd14]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x49df28
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1c], eax
jmp 0x49df2b
mov dword [ebp - 0x1c], eax
jmp 0x49dedf
mov dword [ebp - 4], 0xfffffffe
call fcn.0049df3b
jmp 0x49df43
mov dword [ebp - 4], 0x17
mov dword [ebp - 0xd18], 0
jmp 0x49df65
mov edx, dword [ebp - 0xd18]
add edx, 1
mov dword [ebp - 0xd18], edx
cmp dword [ebp - 0xd18], 3
jge 0x49dfa4
mov eax, dword [ebp - 0xd18]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x49df94
mov eax, dword [ebp - 0xd18]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x49df9f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1c], eax
jmp 0x49dfa2
mov dword [ebp - 0x1c], eax
jmp 0x49df56
mov dword [ebp - 4], 0xfffffffe
call fcn.0049dfb2
jmp 0x49dfba
mov dword [ebp - 4], 0x18
mov dword [ebp - 0xd1c], 0
jmp 0x49dfdc
mov edx, dword [ebp - 0xd1c]
add edx, 1
mov dword [ebp - 0xd1c], edx
cmp dword [ebp - 0xd1c], 2
jge 0x49e023
mov eax, dword [ebp - 0x1c]
cdq
sub eax, edx
sar eax, 1
and eax, 0x80000001
jns 0x49dff9
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x49e009
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x49e021
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x49e021
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x49dfcd
mov dword [ebp - 4], 0xfffffffe
call fcn.0049e031
jmp 0x49e040
mov dword [ebp - 4], 0x19
mov dword [ebp - 0xd20], 0
jmp 0x49e062
mov ecx, dword [ebp - 0xd20]
add ecx, 1
mov dword [ebp - 0xd20], ecx
cmp dword [ebp - 0xd20], 2
jge 0x49e0a9
mov eax, dword [ebp - 0x1c]
cdq
sub eax, edx
sar eax, 1
and eax, 0x80000001
jns 0x49e07f
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x49e08f
mov edx, dword [ebp - 0x1c]
and edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x49e0a7
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x49e0a7
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x49e053
mov dword [ebp - 4], 0xfffffffe
call fcn.0049e0b7
jmp 0x49e0c6
mov dword [ebp - 0xd24], 1
mov dword [ebp - 0xd28], 1
mov dword [ebp - 0xd2c], 2
mov dword [ebp - 0xd30], 0
mov dword [ebp - 0xd34], 0
jmp 0x49e109
mov ecx, dword [ebp - 0xd34]
add ecx, 1
mov dword [ebp - 0xd34], ecx
cmp dword [ebp - 0xd34], 3
jge 0x49e14a
mov edx, dword [ebp - 0xd24]
add edx, dword [ebp - 0xd28]
mov dword [ebp - 0xd2c], edx
mov eax, dword [ebp - 0xd28]
mov dword [ebp - 0xd24], eax
mov ecx, dword [ebp - 0xd2c]
mov dword [ebp - 0xd28], ecx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0xd2c]
mov dword [ebp - 0x1c], edx
jmp 0x49e0fa
mov eax, dword [ebp - 0x1c]
add eax, 3
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xd38], 0
jmp 0x49e16e
mov ecx, dword [ebp - 0xd38]
add ecx, 1
mov dword [ebp - 0xd38], ecx
cmp dword [ebp - 0xd38], 2
jge 0x49e1af
cmp dword [ebp - 0x1c], 0
jge 0x49e185
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x49e19b
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0xf30]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x49e15f
mov dword [ebp - 0xf34], 0
jmp 0x49e1ca
mov eax, dword [ebp - 0xf34]
add eax, 1
mov dword [ebp - 0xf34], eax
cmp dword [ebp - 0xf34], 4
jge 0x49e1e3
mov ecx, dword [ebp - 0xf34]
not ecx
xor ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ecx
jmp 0x49e1bb
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x49e1f7
mov edx, dword [ebp - 0x1c]
neg edx
imul edx, edx, 0xfffffffd
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x49e20d
mov dword [ebp - 0x1c], 0xb
mov dword [ebp - 0xf38], 0
jmp 0x49e228
mov edx, dword [ebp - 0xf38]
add edx, 1
mov dword [ebp - 0xf38], edx
cmp dword [ebp - 0xf38], 1
jge 0x49e269
cmp dword [ebp - 0x1c], 0
jge 0x49e23f
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x49e255
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x1130]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x49e219
mov dword [ebp - 0x1134], 0
jmp 0x49e284
mov eax, dword [ebp - 0x1134]
add eax, 1
mov dword [ebp - 0x1134], eax
cmp dword [ebp - 0x1134], 0
jge 0x49e29d
mov ecx, dword [ebp - 0x1134]
not ecx
xor ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ecx
jmp 0x49e275
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x49e2b1
mov edx, dword [ebp - 0x1c]
neg edx
imul edx, edx, 0xfffffffd
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x49e2c7
mov dword [ebp - 0x1c], 0xb
mov dword [ebp - 0x1138], 0
jmp 0x49e2e2