Function at 0x4ff8a0
Capabilities:
Check os version
Get common file path
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x514b08
push 0x40b390
mov eax, dword fs:[0]
push eax
add esp, 0xfffff380
mov eax, dword [0x517138]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x48], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
jmp 0x4ff8f2
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xf
jge 0x4ff903
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
jmp 0x4ff8e9
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4ff915
mov edx, dword [ebp - 0x1c]
imul edx, edx, 0xfffffffb
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4ff92d
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x28], 0
jmp 0x4ff94d
mov edx, dword [ebp - 0x28]
add edx, 1
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], 8
jge 0x4ff976
mov eax, dword [ebp - 0x28]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4ff96b
mov edx, dword [ebp - 0x24]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4ff944
mov dword [ebp - 4], 0xfffffffe
jmp 0x4ff996
mov dword [ebp - 0x2c], 0
jmp 0x4ff9a8
mov edx, dword [ebp - 0x2c]
add edx, 1
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], 5
jge 0x4ff9b9
mov eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
jmp 0x4ff99f
cmp dword [ebp - 0x1c], 0
jge 0x4ff9c7
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4ff9df
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x30], 0
jmp 0x4ff9f1
mov edx, dword [ebp - 0x30]
add edx, 1
mov dword [ebp - 0x30], edx
cmp dword [ebp - 0x30], 0
jge 0x4ffa2f
mov eax, dword [ebp - 0x30]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4ffa17
mov eax, dword [ebp - 0x30]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4ffa24
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x30]
mov dword [ebp - 0x1c], edx
jmp 0x4ffa2d
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x30]
mov dword [ebp - 0x1c], eax
jmp 0x4ff9e8
mov dword [ebp - 4], 1
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x38], 0
jmp 0x4ffa4f
mov ecx, dword [ebp - 0x38]
add ecx, 1
mov dword [ebp - 0x38], ecx
cmp dword [ebp - 0x38], 0xe
jge 0x4ffa78
mov eax, dword [ebp - 0x38]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4ffa6d
mov edx, dword [ebp - 0x34]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4ffa46
mov dword [ebp - 4], 0xfffffffe
jmp 0x4ffa98
mov dword [ebp - 0x3c], 0
jmp 0x4ffaaa
mov edx, dword [ebp - 0x3c]
add edx, 1
mov dword [ebp - 0x3c], edx
cmp dword [ebp - 0x3c], 0xb
jge 0x4ffae8
mov eax, dword [ebp - 0x3c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4ffad0
mov eax, dword [ebp - 0x3c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4ffadd
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x3c]
mov dword [ebp - 0x1c], edx
jmp 0x4ffae6
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x3c]
mov dword [ebp - 0x1c], eax
jmp 0x4ffaa1
mov dword [ebp - 0x40], 0
jmp 0x4ffafa
mov ecx, dword [ebp - 0x40]
add ecx, 1
mov dword [ebp - 0x40], ecx
cmp dword [ebp - 0x40], 0xc
jge 0x4ffb0b
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x40]
mov dword [ebp - 0x1c], edx
jmp 0x4ffaf1
cmp dword [ebp - 0x1c], 0
jge 0x4ffb19
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4ffb31
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x44], 0
jmp 0x4ffb43
mov edx, dword [ebp - 0x44]
add edx, 1
mov dword [ebp - 0x44], edx
cmp dword [ebp - 0x44], 1
jge 0x4ffb81
cmp dword [ebp - 0x1c], 0
jge 0x4ffb57
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4ffb6d
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x240]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4ffb3a
mov dword [ebp - 0x244], 0
jmp 0x4ffb9c
mov eax, dword [ebp - 0x244]
add eax, 1
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0
jge 0x4ffbb3
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x244]
mov dword [ebp - 0x1c], ecx
jmp 0x4ffb8d
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4ffbc5
mov edx, dword [ebp - 0x1c]
imul edx, edx, 0xfffffffb
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4ffbdd
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov edx, 1
test edx, edx
je 0x4ffc17
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x248], eax
mov eax, dword [ebp - 0x248]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4ffc09
jmp 0x4ffc17
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x248]
mov dword [ebp - 0x1c], edx
jmp 0x4ffbdd
mov eax, dword [ebp - 0x1c]
add eax, 0xe
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24c], 0
jmp 0x4ffc3b
mov ecx, dword [ebp - 0x24c]
add ecx, 1
mov dword [ebp - 0x24c], ecx
cmp dword [ebp - 0x24c], 7
jge 0x4ffc7c
cmp dword [ebp - 0x1c], 0
jge 0x4ffc52
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4ffc68
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x448]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4ffc2c
mov dword [ebp - 0x44c], 0
jmp 0x4ffc97
mov eax, dword [ebp - 0x44c]
add eax, 1
mov dword [ebp - 0x44c], eax
cmp dword [ebp - 0x44c], 3
jge 0x4ffcae
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x44c]
mov dword [ebp - 0x1c], ecx
jmp 0x4ffc88
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4ffcc0
mov edx, dword [ebp - 0x1c]
imul edx, edx, 0xfffffffb
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4ffcd8
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x450], 0
jmp 0x4ffcf3
mov edx, dword [ebp - 0x450]
add edx, 1
mov dword [ebp - 0x450], edx
cmp dword [ebp - 0x450], 0xe
jge 0x4ffd40
mov eax, dword [ebp - 0x450]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4ffd22
mov eax, dword [ebp - 0x450]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4ffd32
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x450]
mov dword [ebp - 0x1c], edx
jmp 0x4ffd3e
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x450]
mov dword [ebp - 0x1c], eax
jmp 0x4ffce4
mov ecx, 1
test ecx, ecx
je 0x4ffd7a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x454], eax
mov eax, dword [ebp - 0x454]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4ffd6c
jmp 0x4ffd7a
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x454]
mov dword [ebp - 0x1c], edx
jmp 0x4ffd40
mov eax, dword [ebp - 0x1c]
add eax, 5
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x458], 0
jmp 0x4ffd9e
mov ecx, dword [ebp - 0x458]
add ecx, 1
mov dword [ebp - 0x458], ecx
cmp dword [ebp - 0x458], 4
jge 0x4ffdeb
mov eax, dword [ebp - 0x458]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4ffdcd
mov eax, dword [ebp - 0x458]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4ffddd
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x458]
mov dword [ebp - 0x1c], edx
jmp 0x4ffde9
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x458]
mov dword [ebp - 0x1c], eax
jmp 0x4ffd8f
mov dword [ebp - 0x45c], 0
jmp 0x4ffe06
mov ecx, dword [ebp - 0x45c]
add ecx, 1
mov dword [ebp - 0x45c], ecx
cmp dword [ebp - 0x45c], 5
jge 0x4ffe53
cmp dword [ebp - 0x1c], 0
jge 0x4ffe1d
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4ffe33
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x460], 0xfa
lea edx, [ebp - 0x460]
push edx
lea eax, [ebp - 0x658]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4ffdf7
mov dword [ebp - 0x65c], 0
jmp 0x4ffe6e
mov ecx, dword [ebp - 0x65c]
add ecx, 1
mov dword [ebp - 0x65c], ecx
cmp dword [ebp - 0x65c], 0
jge 0x4ffe85
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x65c]
mov dword [ebp - 0x1c], edx
jmp 0x4ffe5f
cmp dword [ebp - 0x1c], 0
jge 0x4ffe93
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4ffeab
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x660], 0
jmp 0x4ffec6
mov edx, dword [ebp - 0x660]
add edx, 1
mov dword [ebp - 0x660], edx
cmp dword [ebp - 0x660], 6
jge 0x4ffedd
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x660]
mov dword [ebp - 0x1c], eax
jmp 0x4ffeb7
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4ffeef
mov ecx, dword [ebp - 0x1c]
imul ecx, ecx, 0xfffffffb
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4fff07
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x664], 0
jmp 0x4fff22
mov edx, dword [ebp - 0x664]
add edx, 1
mov dword [ebp - 0x664], edx
cmp dword [ebp - 0x664], 7
jge 0x4fff39
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x664]
mov dword [ebp - 0x1c], eax
jmp 0x4fff13
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4fff4b
mov ecx, dword [ebp - 0x1c]
imul ecx, ecx, 0xfffffffb
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4fff63
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x668], 0
jmp 0x4fff7e
mov edx, dword [ebp - 0x668]
add edx, 1
mov dword [ebp - 0x668], edx
cmp dword [ebp - 0x668], 4
jge 0x4fff95
mov eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 0x668]
mov dword [ebp - 0x1c], eax
jmp 0x4fff6f
cmp dword [ebp - 0x1c], 0
jge 0x4fffa3
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4fffbb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 2
mov dword [ebp - 0x66c], 0xffffffff
mov dword [ebp - 0x670], 0
jmp 0x4fffe7
mov edx, dword [ebp - 0x670]
add edx, 1
mov dword [ebp - 0x670], edx
cmp dword [ebp - 0x670], 6
jge 0x500019
mov eax, dword [ebp - 0x670]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x50000e
mov edx, dword [ebp - 0x66c]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4fffd8
mov dword [ebp - 4], 0xfffffffe
jmp 0x500039
mov dword [ebp - 0x674], 0
jmp 0x500054
mov edx, dword [ebp - 0x674]
add edx, 1
mov dword [ebp - 0x674], edx
cmp dword [ebp - 0x674], 1
jge 0x500095
cmp dword [ebp - 0x1c], 0
jge 0x50006b
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x500081
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x870]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x500045
mov dword [ebp - 0x874], 0
jmp 0x5000b0
mov eax, dword [ebp - 0x874]
add eax, 1
mov dword [ebp - 0x874], eax
cmp dword [ebp - 0x874], 4
jge 0x5000c7
mov ecx, dword [ebp - 0x1c]
xor ecx, dword [ebp - 0x874]
mov dword [ebp - 0x1c], ecx
jmp 0x5000a1
cmp dword [ebp - 0x1c], 0
jge 0x5000d5
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x5000ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 3
mov dword [ebp - 0x878], 0xffffffff
mov dword [ebp - 0x87c], 0
jmp 0x500119
mov edx, dword [ebp - 0x87c]
add edx, 1
mov dword [ebp - 0x87c], edx
cmp dword [ebp - 0x87c], 3
jge 0x50014b
mov eax, dword [ebp - 0x87c]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x500140
mov edx, dword [ebp - 0x878]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x50010a
mov dword [ebp - 4], 0xfffffffe
jmp 0x50016b
mov dword [ebp - 0x880], 0
jmp 0x500186
mov edx, dword [ebp - 0x880]
add edx, 1
mov dword [ebp - 0x880], edx
cmp dword [ebp - 0x880], 7
jge 0x50019d
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x880]
mov dword [ebp - 0x1c], eax
jmp 0x500177
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x5001af
mov ecx, dword [ebp - 0x1c]
imul ecx, ecx, 0xfffffffb
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x5001c7
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov edx, 1
test edx, edx
je 0x500201
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x884], eax
mov eax, dword [ebp - 0x884]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x5001f3
jmp 0x500201
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x884]
mov dword [ebp - 0x1c], edx
jmp 0x5001c7
mov eax, dword [ebp - 0x1c]
add eax, 5
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x888], 0
jmp 0x500225
mov ecx, dword [ebp - 0x888]
add ecx, 1
mov dword [ebp - 0x888], ecx
cmp dword [ebp - 0x888], 0
jge 0x50023c
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x888]
mov dword [ebp - 0x1c], edx
jmp 0x500216
cmp dword [ebp - 0x1c], 0
jge 0x50024a
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x500262
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x88c], 0
jmp 0x50027d
mov edx, dword [ebp - 0x88c]
add edx, 1
mov dword [ebp - 0x88c], edx
cmp dword [ebp - 0x88c], 4
jge 0x5002ca
mov eax, dword [ebp - 0x88c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x5002ac
mov eax, dword [ebp - 0x88c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x5002bc
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x88c]
mov dword [ebp - 0x1c], edx
jmp 0x5002c8
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x88c]
mov dword [ebp - 0x1c], eax
jmp 0x50026e
mov dword [ebp - 0x890], 0
jmp 0x5002e5
mov ecx, dword [ebp - 0x890]
add ecx, 1
mov dword [ebp - 0x890], ecx
cmp dword [ebp - 0x890], 4
jge 0x500326
cmp dword [ebp - 0x1c], 0
jge 0x5002fc
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x500312
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0xa88]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x5002d6
mov dword [ebp - 0xa8c], 0
jmp 0x500341
mov eax, dword [ebp - 0xa8c]
add eax, 1
mov dword [ebp - 0xa8c], eax
cmp dword [ebp - 0xa8c], 3
jge 0x50038e
mov eax, dword [ebp - 0xa8c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x500370
mov eax, dword [ebp - 0xa8c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x500380
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0xa8c]
mov dword [ebp - 0x1c], edx
jmp 0x50038c
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0xa8c]
mov dword [ebp - 0x1c], eax
jmp 0x500332
mov dword [ebp - 4], 4
mov dword [ebp - 0xa90], 0xffffffff
mov dword [ebp - 0xa94], 0
jmp 0x5003ba
mov ecx, dword [ebp - 0xa94]
add ecx, 1
mov dword [ebp - 0xa94], ecx
cmp dword [ebp - 0xa94], 4
jge 0x5003ec
mov eax, dword [ebp - 0xa94]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x5003e1
mov edx, dword [ebp - 0xa90]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x5003ab
mov dword [ebp - 4], 0xfffffffe
jmp 0x50040c
mov dword [ebp - 0xa98], 0
jmp 0x500427
mov edx, dword [ebp - 0xa98]
add edx, 1
mov dword [ebp - 0xa98], edx
cmp dword [ebp - 0xa98], 1
jge 0x500468
cmp dword [ebp - 0x1c], 0
jge 0x50043e
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x500454
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0xc90]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x500418
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x48]
xor ecx, ebp
call fcn.004079a5
mov esp, ebp
pop ebp
ret