Function at 0x4660a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4b66f0
push 0x40d810
mov eax, dword fs:[0]
push eax
add esp, 0xfffff2f8
mov eax, dword [0x4bc534]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x44], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 0
jmp 0x4660f6
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x1e
jge 0x466128
mov eax, dword [ebp - 0x20]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x46611c
mov eax, dword [ebp - 0x20]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x466123
and eax, 0xbc614e
jmp 0x466126
mov dword [ebp - 0x1c], eax
jmp 0x4660ed
mov dword [ebp - 4], 0xfffffffe
call fcn.00466136
jmp 0x46613e
mov dword [ebp - 4], 1
mov dword [ebp - 0x24], 0
jmp 0x466157
mov edx, dword [ebp - 0x24]
add edx, 1
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], 0x10
jge 0x466187
mov eax, dword [ebp - 0x24]
and eax, 0x80000001
jns 0x46616c
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x46617c
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x466185
mov edx, dword [ebp - 0x1c]
sub edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x46614e
mov dword [ebp - 4], 0xfffffffe
call fcn.00466195
jmp 0x4661b2
mov dword [ebp - 4], 2
mov dword [ebp - 0x28], 0
jmp 0x4661cb
mov edx, dword [ebp - 0x28]
add edx, 1
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], 0xa
jge 0x4661fb
mov eax, dword [ebp - 0x28]
and eax, 0x80000001
jns 0x4661e0
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x4661f0
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4661f9
mov edx, dword [ebp - 0x1c]
sub edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x4661c2
mov dword [ebp - 4], 0xfffffffe
call fcn.00466209
jmp 0x466226
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x34], 2
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], 0
jmp 0x466254
mov edx, dword [ebp - 0x3c]
add edx, 1
mov dword [ebp - 0x3c], edx
cmp dword [ebp - 0x3c], 0x17
jge 0x46627a
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x1c], eax
jmp 0x46624b
mov ecx, dword [ebp - 0x1c]
add ecx, 0x17
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x40], 0
jmp 0x466295
mov edx, dword [ebp - 0x40]
add edx, 1
mov dword [ebp - 0x40], edx
cmp dword [ebp - 0x40], 6
jge 0x4662d3
cmp dword [ebp - 0x1c], 0
jge 0x4662a9
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4662bf
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x240]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x46628c
mov dword [ebp - 4], 3
mov dword [ebp - 0x244], 0
jmp 0x4662f5
mov eax, dword [ebp - 0x244]
add eax, 1
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 9
jge 0x46633c
mov eax, dword [ebp - 0x1c]
cdq
sub eax, edx
sar eax, 1
and eax, 0x80000001
jns 0x466312
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x466322
mov ecx, dword [ebp - 0x1c]
and ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ecx
jmp 0x46633a
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x46633a
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x4662e6
mov dword [ebp - 4], 0xfffffffe
call fcn.0046634a
jmp 0x466359
mov dword [ebp - 4], 4
mov dword [ebp - 0x248], 0
jmp 0x46637b
mov ecx, dword [ebp - 0x248]
add ecx, 1
mov dword [ebp - 0x248], ecx
cmp dword [ebp - 0x248], 5
jge 0x4663b2
mov edx, dword [ebp - 0x248]
and edx, 0x80000001
jns 0x466397
dec edx
or edx, 0xfffffffe
inc edx
cmp edx, 1
jne 0x4663a7
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
jmp 0x4663b0
mov ecx, dword [ebp - 0x1c]
sub ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x46636c
mov dword [ebp - 4], 0xfffffffe
call fcn.004663c0
jmp 0x4663de
mov dword [ebp - 4], 5
mov dword [ebp - 0x24c], 0
jmp 0x466400
mov ecx, dword [ebp - 0x24c]
add ecx, 1
mov dword [ebp - 0x24c], ecx
cmp dword [ebp - 0x24c], 4
jge 0x466437
mov edx, dword [ebp - 0x24c]
and edx, 0x80000001
jns 0x46641c
dec edx
or edx, 0xfffffffe
inc edx
cmp edx, 1
jne 0x46642c
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
jmp 0x466435
mov ecx, dword [ebp - 0x1c]
sub ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4663f1
mov dword [ebp - 4], 0xfffffffe
call fcn.00466445
jmp 0x466463
mov dword [ebp - 4], 6
mov dword [ebp - 0x250], 0
jmp 0x466485
mov ecx, dword [ebp - 0x250]
add ecx, 1
mov dword [ebp - 0x250], ecx
cmp dword [ebp - 0x250], 6
jge 0x4664c4
mov eax, dword [ebp - 0x250]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x4664b4
mov eax, dword [ebp - 0x250]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x4664bf
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1c], eax
jmp 0x4664c2
mov dword [ebp - 0x1c], eax
jmp 0x466476
mov dword [ebp - 4], 0xfffffffe
call fcn.004664d2
jmp 0x4664da
mov dword [ebp - 0x254], 0
jmp 0x4664f5
mov edx, dword [ebp - 0x254]
add edx, 1
mov dword [ebp - 0x254], edx
cmp dword [ebp - 0x254], 9
jge 0x466536
cmp dword [ebp - 0x1c], 0
jge 0x46650c
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x466522
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x450]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4664e6
mov dword [ebp - 4], 7
mov dword [ebp - 0x454], 0
jmp 0x466558
mov eax, dword [ebp - 0x454]
add eax, 1
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0xf
jge 0x466593
mov eax, dword [ebp - 0x454]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x466587
mov eax, dword [ebp - 0x454]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x46658e
and eax, 0xbc614e
jmp 0x466591
mov dword [ebp - 0x1c], eax
jmp 0x466549
mov dword [ebp - 4], 0xfffffffe
call fcn.004665a1
jmp 0x4665a9
mov dword [ebp - 0x458], 1
mov dword [ebp - 0x45c], 1
mov dword [ebp - 0x460], 2
mov dword [ebp - 0x464], 0
mov dword [ebp - 0x468], 0
jmp 0x4665ec
mov edx, dword [ebp - 0x468]
add edx, 1
mov dword [ebp - 0x468], edx
cmp dword [ebp - 0x468], 6
jge 0x46662d
mov eax, dword [ebp - 0x458]
add eax, dword [ebp - 0x45c]
mov dword [ebp - 0x460], eax
mov ecx, dword [ebp - 0x45c]
mov dword [ebp - 0x458], ecx
mov edx, dword [ebp - 0x460]
mov dword [ebp - 0x45c], edx
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x460]
mov dword [ebp - 0x1c], eax
jmp 0x4665dd
mov ecx, dword [ebp - 0x1c]
add ecx, 6
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 8
mov dword [ebp - 0x46c], 0
jmp 0x466658
mov edx, dword [ebp - 0x46c]
add edx, 1
mov dword [ebp - 0x46c], edx
cmp dword [ebp - 0x46c], 4
jge 0x46669f
mov eax, dword [ebp - 0x1c]
cdq
sub eax, edx
sar eax, 1
and eax, 0x80000001
jns 0x466675
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x466685
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x46669d
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x46669d
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x466649
mov dword [ebp - 4], 0xfffffffe
call fcn.004666ad
jmp 0x4666bc
mov dword [ebp - 0x470], 0
jmp 0x4666d7
mov ecx, dword [ebp - 0x470]
add ecx, 1
mov dword [ebp - 0x470], ecx
cmp dword [ebp - 0x470], 6
jge 0x4666f0
mov edx, dword [ebp - 0x470]
not edx
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x4666c8
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x466704
mov eax, dword [ebp - 0x1c]
neg eax
imul eax, eax, 0xfffffffd
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x46671a
mov dword [ebp - 0x1c], 0xb
mov dword [ebp - 4], 9
mov dword [ebp - 0x474], 0
jmp 0x46673c
mov edx, dword [ebp - 0x474]
add edx, 1
mov dword [ebp - 0x474], edx
cmp dword [ebp - 0x474], 4
jge 0x466772
mov eax, dword [ebp - 0x474]
and eax, 0x80000001
jns 0x466757
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x466767
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x466770
mov edx, dword [ebp - 0x1c]
sub edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x46672d
mov dword [ebp - 4], 0xfffffffe
call fcn.00466780
jmp 0x46679d
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x478], 0
jmp 0x4667bf
mov edx, dword [ebp - 0x478]
add edx, 1
mov dword [ebp - 0x478], edx
cmp dword [ebp - 0x478], 2
jge 0x4667fa
mov eax, dword [ebp - 0x478]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x4667ee
mov eax, dword [ebp - 0x478]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x4667f5
and eax, 0xbc614e
jmp 0x4667f8
mov dword [ebp - 0x1c], eax
jmp 0x4667b0
mov dword [ebp - 4], 0xfffffffe
call fcn.00466808
jmp 0x466810
mov dword [ebp - 0x47c], 1
mov dword [ebp - 0x480], 1
mov dword [ebp - 0x484], 2
mov dword [ebp - 0x488], 0
mov dword [ebp - 0x48c], 0
jmp 0x466853
mov edx, dword [ebp - 0x48c]
add edx, 1
mov dword [ebp - 0x48c], edx
cmp dword [ebp - 0x48c], 1
jge 0x466894
mov eax, dword [ebp - 0x47c]
add eax, dword [ebp - 0x480]
mov dword [ebp - 0x484], eax
mov ecx, dword [ebp - 0x480]
mov dword [ebp - 0x47c], ecx
mov edx, dword [ebp - 0x484]
mov dword [ebp - 0x480], edx
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x484]
mov dword [ebp - 0x1c], eax
jmp 0x466844
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x490], 0
jmp 0x4668bf
mov edx, dword [ebp - 0x490]
add edx, 1
mov dword [ebp - 0x490], edx
cmp dword [ebp - 0x490], 9
jge 0x466906
mov eax, dword [ebp - 0x1c]
cdq
sub eax, edx
sar eax, 1
and eax, 0x80000001
jns 0x4668dc
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x4668ec
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x466904
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x466904
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x4668b0
mov dword [ebp - 4], 0xfffffffe
call fcn.00466914
jmp 0x466923
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x494], 0
jmp 0x466945
mov ecx, dword [ebp - 0x494]
add ecx, 1
mov dword [ebp - 0x494], ecx
cmp dword [ebp - 0x494], 4
jge 0x46697c
mov edx, dword [ebp - 0x494]
and edx, 0x80000001
jns 0x466961
dec edx
or edx, 0xfffffffe
inc edx
cmp edx, 1
jne 0x466971
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
jmp 0x46697a
mov ecx, dword [ebp - 0x1c]
sub ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x466936
mov dword [ebp - 4], 0xfffffffe
call fcn.0046698a
jmp 0x4669a8
mov dword [ebp - 0x498], 0
jmp 0x4669c3
mov ecx, dword [ebp - 0x498]
add ecx, 1
mov dword [ebp - 0x498], ecx
cmp dword [ebp - 0x498], 7
jge 0x466a04
cmp dword [ebp - 0x1c], 0
jge 0x4669da
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4669f0
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x690]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4669b4
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x694], 0
jmp 0x466a26
mov eax, dword [ebp - 0x694]
add eax, 1
mov dword [ebp - 0x694], eax
cmp dword [ebp - 0x694], 0
jge 0x466a65
mov eax, dword [ebp - 0x694]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x466a55
mov eax, dword [ebp - 0x694]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x466a60
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1c], eax
jmp 0x466a63
mov dword [ebp - 0x1c], eax
jmp 0x466a17
mov dword [ebp - 4], 0xfffffffe
call fcn.00466a73
jmp 0x466a7b
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x698], 0
jmp 0x466a9d
mov edx, dword [ebp - 0x698]
add edx, 1
mov dword [ebp - 0x698], edx
cmp dword [ebp - 0x698], 3
jge 0x466ad8
mov eax, dword [ebp - 0x698]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x466acc
mov eax, dword [ebp - 0x698]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x466ad3
and eax, 0xbc614e
jmp 0x466ad6
mov dword [ebp - 0x1c], eax
jmp 0x466a8e
mov dword [ebp - 4], 0xfffffffe
call fcn.00466ae6
jmp 0x466aee
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x69c], 0
jmp 0x466b10
mov edx, dword [ebp - 0x69c]
add edx, 1
mov dword [ebp - 0x69c], edx
cmp dword [ebp - 0x69c], 4
jge 0x466b4b
mov eax, dword [ebp - 0x69c]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x466b3f
mov eax, dword [ebp - 0x69c]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x466b46
and eax, 0xbc614e
jmp 0x466b49
mov dword [ebp - 0x1c], eax
jmp 0x466b01
mov dword [ebp - 4], 0xfffffffe
call fcn.00466b59
jmp 0x466b61
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x6a0], 0
jmp 0x466b83
mov edx, dword [ebp - 0x6a0]
add edx, 1
mov dword [ebp - 0x6a0], edx
cmp dword [ebp - 0x6a0], 4
jge 0x466bbe
mov eax, dword [ebp - 0x6a0]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x466bb2
mov eax, dword [ebp - 0x6a0]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x466bb9
and eax, 0xbc614e
jmp 0x466bbc
mov dword [ebp - 0x1c], eax
jmp 0x466b74
mov dword [ebp - 4], 0xfffffffe
call fcn.00466bcc
jmp 0x466bd4
mov dword [ebp - 0x6a4], 1
mov dword [ebp - 0x6a8], 1
mov dword [ebp - 0x6ac], 2
mov dword [ebp - 0x6b0], 0
mov dword [ebp - 0x6b4], 0
jmp 0x466c17
mov edx, dword [ebp - 0x6b4]
add edx, 1
mov dword [ebp - 0x6b4], edx
cmp dword [ebp - 0x6b4], 0
jge 0x466c58
mov eax, dword [ebp - 0x6a4]
add eax, dword [ebp - 0x6a8]
mov dword [ebp - 0x6ac], eax
mov ecx, dword [ebp - 0x6a8]
mov dword [ebp - 0x6a4], ecx
mov edx, dword [ebp - 0x6ac]
mov dword [ebp - 0x6a8], edx
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x6ac]
mov dword [ebp - 0x1c], eax
jmp 0x466c08
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x6b8], 1
mov dword [ebp - 0x6bc], 1
mov dword [ebp - 0x6c0], 2
mov dword [ebp - 0x6c4], 0
mov dword [ebp - 0x6c8], 0
jmp 0x466ca1
mov edx, dword [ebp - 0x6c8]
add edx, 1
mov dword [ebp - 0x6c8], edx
cmp dword [ebp - 0x6c8], 4
jge 0x466ce2
mov eax, dword [ebp - 0x6b8]
add eax, dword [ebp - 0x6bc]
mov dword [ebp - 0x6c0], eax
mov ecx, dword [ebp - 0x6bc]
mov dword [ebp - 0x6b8], ecx
mov edx, dword [ebp - 0x6c0]
mov dword [ebp - 0x6bc], edx
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x6c0]
mov dword [ebp - 0x1c], eax
jmp 0x466c92
mov ecx, dword [ebp - 0x1c]
add ecx, 4
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x6cc], 0
jmp 0x466d0d
mov edx, dword [ebp - 0x6cc]
add edx, 1
mov dword [ebp - 0x6cc], edx
cmp dword [ebp - 0x6cc], 4
jge 0x466d48
mov eax, dword [ebp - 0x6cc]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x466d3c
mov eax, dword [ebp - 0x6cc]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x466d43
and eax, 0xbc614e
jmp 0x466d46
mov dword [ebp - 0x1c], eax
jmp 0x466cfe
mov dword [ebp - 4], 0xfffffffe
call fcn.00466d56
jmp 0x466d5e
mov dword [ebp - 0x6d0], 0
jmp 0x466d79
mov edx, dword [ebp - 0x6d0]
add edx, 1
mov dword [ebp - 0x6d0], edx
cmp dword [ebp - 0x6d0], 3
jge 0x466dba
cmp dword [ebp - 0x1c], 0
jge 0x466d90
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x466da6
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x8c8]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x466d6a
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x8cc], 0
jmp 0x466ddc
mov eax, dword [ebp - 0x8cc]
add eax, 1
mov dword [ebp - 0x8cc], eax
cmp dword [ebp - 0x8cc], 2
jge 0x466e23
mov eax, dword [ebp - 0x1c]
cdq
sub eax, edx
sar eax, 1
and eax, 0x80000001
jns 0x466df9
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x466e09
mov ecx, dword [ebp - 0x1c]
and ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ecx
jmp 0x466e21
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x466e21
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x466dcd
mov dword [ebp - 4], 0xfffffffe
call fcn.00466e31
jmp 0x466e40
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x8d0], 0
jmp 0x466e62
mov ecx, dword [ebp - 0x8d0]
add ecx, 1
mov dword [ebp - 0x8d0], ecx
cmp dword [ebp - 0x8d0], 3
jge 0x466e99
mov edx, dword [ebp - 0x8d0]
and edx, 0x80000001
jns 0x466e7e
dec edx
or edx, 0xfffffffe
inc edx
cmp edx, 1
jne 0x466e8e
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
jmp 0x466e97
mov ecx, dword [ebp - 0x1c]
sub ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x466e53
mov dword [ebp - 4], 0xfffffffe
call fcn.00466ea7
jmp 0x466ec5
mov dword [ebp - 0x8d4], 1
mov dword [ebp - 0x8d8], 1
mov dword [ebp - 0x8dc], 2
mov dword [ebp - 0x8e0], 0
mov dword [ebp - 0x8e4], 0
jmp 0x466f08
mov ecx, dword [ebp - 0x8e4]
add ecx, 1
mov dword [ebp - 0x8e4], ecx
cmp dword [ebp - 0x8e4], 3
jge 0x466f49
mov edx, dword [ebp - 0x8d4]
add edx, dword [ebp - 0x8d8]
mov dword [ebp - 0x8dc], edx
mov eax, dword [ebp - 0x8d8]
mov dword [ebp - 0x8d4], eax
mov ecx, dword [ebp - 0x8dc]
mov dword [ebp - 0x8d8], ecx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x8dc]
mov dword [ebp - 0x1c], edx
jmp 0x466ef9
mov eax, dword [ebp - 0x1c]
add eax, 3
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x8e8], 1
mov dword [ebp - 0x8ec], 1
mov dword [ebp - 0x8f0], 2
mov dword [ebp - 0x8f4], 0
mov dword [ebp - 0x8f8], 0
jmp 0x466f95
mov ecx, dword [ebp - 0x8f8]
add ecx, 1
mov dword [ebp - 0x8f8], ecx
cmp dword [ebp - 0x8f8], 4
jge 0x466fd6
mov edx, dword [ebp - 0x8e8]
add edx, dword [ebp - 0x8ec]
mov dword [ebp - 0x8f0], edx
mov eax, dword [ebp - 0x8ec]
mov dword [ebp - 0x8e8], eax
mov ecx, dword [ebp - 0x8f0]
mov dword [ebp - 0x8ec], ecx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x8f0]
mov dword [ebp - 0x1c], edx
jmp 0x466f86
mov eax, dword [ebp - 0x1c]
add eax, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x8fc], 0
jmp 0x467001
mov ecx, dword [ebp - 0x8fc]
add ecx, 1
mov dword [ebp - 0x8fc], ecx
cmp dword [ebp - 0x8fc], 4
jge 0x467038
mov edx, dword [ebp - 0x8fc]
and edx, 0x80000001
jns 0x46701d
dec edx
or edx, 0xfffffffe
inc edx
cmp edx, 1
jne 0x46702d
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
jmp 0x467036
mov ecx, dword [ebp - 0x1c]
sub ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x466ff2
mov dword [ebp - 4], 0xfffffffe
call fcn.00467046
jmp 0x467064
mov dword [ebp - 0x900], 0
jmp 0x46707f
mov ecx, dword [ebp - 0x900]
add ecx, 1
mov dword [ebp - 0x900], ecx
cmp dword [ebp - 0x900], 2
jge 0x4670c0
cmp dword [ebp - 0x1c], 0
jge 0x467096
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4670ac
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0xaf8]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x467070
mov dword [ebp - 0xafc], 0
jmp 0x4670db
mov eax, dword [ebp - 0xafc]
add eax, 1
mov dword [ebp - 0xafc], eax
cmp dword [ebp - 0xafc], 3
jge 0x4670f4
mov ecx, dword [ebp - 0xafc]
not ecx
xor ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ecx
jmp 0x4670cc
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x467108
mov edx, dword [ebp - 0x1c]
neg edx
imul edx, edx, 0xfffffffd
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x46711e
mov dword [ebp - 0x1c], 0xb
mov dword [ebp - 4], 0x15
mov dword [ebp - 0xb00], 0
jmp 0x467140
mov edx, dword [ebp - 0xb00]
add edx, 1
mov dword [ebp - 0xb00], edx
cmp dword [ebp - 0xb00], 1
jge 0x467187
mov eax, dword [ebp - 0x1c]
cdq
sub eax, edx
sar eax, 1
and eax, 0x80000001
jns 0x46715d
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x46716d
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x467185
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x467185
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x467131
mov dword [ebp - 4], 0xfffffffe
call fcn.00467195
jmp 0x4671a4
mov dword [ebp - 0xb04], 0
jmp 0x4671bf
mov ecx, dword [ebp - 0xb04]
add ecx, 1
mov dword [ebp - 0xb04], ecx
cmp dword [ebp - 0xb04], 2
jge 0x4671d8
mov edx, dword [ebp - 0xb04]
not edx
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x4671b0
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4671ec
mov eax, dword [ebp - 0x1c]
neg eax
imul eax, eax, 0xfffffffd
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x467202
mov dword [ebp - 0x1c], 0xb
mov dword [ebp - 0xb08], 0
jmp 0x46721d
mov edx, dword [ebp - 0xb08]
add edx, 1
mov dword [ebp - 0xb08], edx
cmp dword [ebp - 0xb08], 2
jge 0x467236
mov eax, dword [ebp - 0xb08]
not eax
xor eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x46720e
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x46724a
mov ecx, dword [ebp - 0x1c]
neg ecx
imul ecx, ecx, 0xfffffffd
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x467260
mov dword [ebp - 0x1c], 0xb
mov dword [ebp - 0xb0c], 1
mov dword [ebp - 0xb10], 1
mov dword [ebp - 0xb14], 2
mov dword [ebp - 0xb18], 0
mov dword [ebp - 0xb1c], 0
jmp 0x4672a3
mov edx, dword [ebp - 0xb1c]
add edx, 1
mov dword [ebp - 0xb1c], edx
cmp dword [ebp - 0xb1c], 3
jge 0x4672e4
mov eax, dword [ebp - 0xb0c]
add eax, dword [ebp - 0xb10]
mov dword [ebp - 0xb14], eax
mov ecx, dword [ebp - 0xb10]
mov dword [ebp - 0xb0c], ecx
mov edx, dword [ebp - 0xb14]
mov dword [ebp - 0xb10], edx
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0xb14]
mov dword [ebp - 0x1c], eax
jmp 0x467294
mov ecx, dword [ebp - 0x1c]
add ecx, 3
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0xb20], 0
jmp 0x467308
mov edx, dword [ebp - 0xb20]
add edx, 1
mov dword [ebp - 0xb20], edx
cmp dword [ebp - 0xb20], 2
jge 0x467349
cmp dword [ebp - 0x1c], 0
jge 0x46731f
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x467335
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0xd18]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4672f9
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x44]
xor ecx, ebp
call fcn.00408023
mov esp, ebp
pop ebp
ret