Function at 0x435140
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4b3720
push 0x40d810
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x1240
call fcn.004175a0
mov eax, dword [0x4bc534]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x5c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 0
jmp 0x43519d
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x4351d3
mov eax, dword [ebp - 0x20]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x4351c3
mov eax, dword [ebp - 0x20]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x4351ce
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1c], eax
jmp 0x4351d1
mov dword [ebp - 0x1c], eax
jmp 0x435194
mov dword [ebp - 4], 0xfffffffe
call fcn.004351e1
jmp 0x4351e9
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x2c], 2
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
jmp 0x435217
mov edx, dword [ebp - 0x34]
add edx, 1
mov dword [ebp - 0x34], edx
cmp dword [ebp - 0x34], 0x1d
jge 0x43523d
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
jmp 0x43520e
mov ecx, dword [ebp - 0x1c]
add ecx, 0x1d
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 1
mov dword [ebp - 0x38], 0
jmp 0x43525f
mov edx, dword [ebp - 0x38]
add edx, 1
mov dword [ebp - 0x38], edx
cmp dword [ebp - 0x38], 0xc
jge 0x435291
mov eax, dword [ebp - 0x38]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x435285
mov eax, dword [ebp - 0x38]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x43528c
and eax, 0xbc614e
jmp 0x43528f
mov dword [ebp - 0x1c], eax
jmp 0x435256
mov dword [ebp - 4], 0xfffffffe
call fcn.0043529f
jmp 0x4352a7
mov dword [ebp - 0x3c], 0
jmp 0x4352b9
mov edx, dword [ebp - 0x3c]
add edx, 1
mov dword [ebp - 0x3c], edx
cmp dword [ebp - 0x3c], 8
jge 0x4352cc
mov eax, dword [ebp - 0x3c]
not eax
xor eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x4352b0
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4352e0
mov ecx, dword [ebp - 0x1c]
neg ecx
imul ecx, ecx, 0xfffffffd
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4352f6
mov dword [ebp - 0x1c], 0xb
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x48], 2
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x50], 0
jmp 0x435324
mov edx, dword [ebp - 0x50]
add edx, 1
mov dword [ebp - 0x50], edx
cmp dword [ebp - 0x50], 7
jge 0x43534a
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x40], ecx
mov edx, dword [ebp - 0x48]
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x48]
mov dword [ebp - 0x1c], eax
jmp 0x43531b
mov ecx, dword [ebp - 0x1c]
add ecx, 7
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 2
mov dword [ebp - 0x54], 0
jmp 0x43536c
mov edx, dword [ebp - 0x54]
add edx, 1
mov dword [ebp - 0x54], edx
cmp dword [ebp - 0x54], 5
jge 0x4353a2
mov eax, dword [ebp - 0x54]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x435392
mov eax, dword [ebp - 0x54]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x43539d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1c], eax
jmp 0x4353a0
mov dword [ebp - 0x1c], eax
jmp 0x435363
mov dword [ebp - 4], 0xfffffffe
call fcn.004353b0
jmp 0x4353b8
mov dword [ebp - 0x58], 0
jmp 0x4353ca
mov edx, dword [ebp - 0x58]
add edx, 1
mov dword [ebp - 0x58], edx
cmp dword [ebp - 0x58], 3
jge 0x435408
cmp dword [ebp - 0x1c], 0
jge 0x4353de
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4353f4
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x258]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4353c1
mov dword [ebp - 0x25c], 0
jmp 0x435423
mov eax, dword [ebp - 0x25c]
add eax, 1
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 6
jge 0x43543c
mov ecx, dword [ebp - 0x25c]
not ecx
xor ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ecx
jmp 0x435414
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x435450
mov edx, dword [ebp - 0x1c]
neg edx
imul edx, edx, 0xfffffffd
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x435466
mov dword [ebp - 0x1c], 0xb
mov dword [ebp - 4], 3
mov dword [ebp - 0x260], 0
jmp 0x435488
mov edx, dword [ebp - 0x260]
add edx, 1
mov dword [ebp - 0x260], edx
cmp dword [ebp - 0x260], 8
jge 0x4354c3
mov eax, dword [ebp - 0x260]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x4354b7
mov eax, dword [ebp - 0x260]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x4354be
and eax, 0xbc614e
jmp 0x4354c1
mov dword [ebp - 0x1c], eax
jmp 0x435479
mov dword [ebp - 4], 0xfffffffe
call fcn.004354d1
jmp 0x4354d9
mov dword [ebp - 0x264], 1
mov dword [ebp - 0x268], 1
mov dword [ebp - 0x26c], 2
mov dword [ebp - 0x270], 0
mov dword [ebp - 0x274], 0
jmp 0x43551c
mov edx, dword [ebp - 0x274]
add edx, 1
mov dword [ebp - 0x274], edx
cmp dword [ebp - 0x274], 2
jge 0x43555d
mov eax, dword [ebp - 0x264]
add eax, dword [ebp - 0x268]
mov dword [ebp - 0x26c], eax
mov ecx, dword [ebp - 0x268]
mov dword [ebp - 0x264], ecx
mov edx, dword [ebp - 0x26c]
mov dword [ebp - 0x268], edx
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x26c]
mov dword [ebp - 0x1c], eax
jmp 0x43550d
mov ecx, dword [ebp - 0x1c]
add ecx, 2
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 4
mov dword [ebp - 0x278], 0
jmp 0x435588
mov edx, dword [ebp - 0x278]
add edx, 1
mov dword [ebp - 0x278], edx
cmp dword [ebp - 0x278], 3
jge 0x4355c7
mov eax, dword [ebp - 0x278]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x4355b7
mov eax, dword [ebp - 0x278]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x4355c2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1c], eax
jmp 0x4355c5
mov dword [ebp - 0x1c], eax
jmp 0x435579
mov dword [ebp - 4], 0xfffffffe
call fcn.004355d5
jmp 0x4355dd
mov dword [ebp - 0x27c], 0
jmp 0x4355f8
mov edx, dword [ebp - 0x27c]
add edx, 1
mov dword [ebp - 0x27c], edx
cmp dword [ebp - 0x27c], 0
jge 0x435611
mov eax, dword [ebp - 0x27c]
not eax
xor eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x4355e9
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x435625
mov ecx, dword [ebp - 0x1c]
neg ecx
imul ecx, ecx, 0xfffffffd
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x43563b
mov dword [ebp - 0x1c], 0xb
mov dword [ebp - 4], 5
mov dword [ebp - 0x280], 0
jmp 0x43565d
mov edx, dword [ebp - 0x280]
add edx, 1
mov dword [ebp - 0x280], edx
cmp dword [ebp - 0x280], 2
jge 0x43569c
mov eax, dword [ebp - 0x280]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x43568c
mov eax, dword [ebp - 0x280]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x435697
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1c], eax
jmp 0x43569a
mov dword [ebp - 0x1c], eax
jmp 0x43564e
mov dword [ebp - 4], 0xfffffffe
call fcn.004356aa
jmp 0x4356b2
mov dword [ebp - 0x284], 0
jmp 0x4356cd
mov edx, dword [ebp - 0x284]
add edx, 1
mov dword [ebp - 0x284], edx
cmp dword [ebp - 0x284], 2
jge 0x4356e6
mov eax, dword [ebp - 0x284]
not eax
xor eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x4356be
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4356fa
mov ecx, dword [ebp - 0x1c]
neg ecx
imul ecx, ecx, 0xfffffffd
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x435710
mov dword [ebp - 0x1c], 0xb
mov dword [ebp - 0x288], 1
mov dword [ebp - 0x28c], 1
mov dword [ebp - 0x290], 2
mov dword [ebp - 0x294], 0
mov dword [ebp - 0x298], 0
jmp 0x435753
mov edx, dword [ebp - 0x298]
add edx, 1
mov dword [ebp - 0x298], edx
cmp dword [ebp - 0x298], 1
jge 0x435794
mov eax, dword [ebp - 0x288]
add eax, dword [ebp - 0x28c]
mov dword [ebp - 0x290], eax
mov ecx, dword [ebp - 0x28c]
mov dword [ebp - 0x288], ecx
mov edx, dword [ebp - 0x290]
mov dword [ebp - 0x28c], edx
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x290]
mov dword [ebp - 0x1c], eax
jmp 0x435744
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x29c], 1
mov dword [ebp - 0x2a0], 1
mov dword [ebp - 0x2a4], 2
mov dword [ebp - 0x2a8], 0
mov dword [ebp - 0x2ac], 0
jmp 0x4357e0
mov edx, dword [ebp - 0x2ac]
add edx, 1
mov dword [ebp - 0x2ac], edx
cmp dword [ebp - 0x2ac], 4
jge 0x435821
mov eax, dword [ebp - 0x29c]
add eax, dword [ebp - 0x2a0]
mov dword [ebp - 0x2a4], eax
mov ecx, dword [ebp - 0x2a0]
mov dword [ebp - 0x29c], ecx
mov edx, dword [ebp - 0x2a4]
mov dword [ebp - 0x2a0], edx
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x2a4]
mov dword [ebp - 0x1c], eax
jmp 0x4357d1
mov ecx, dword [ebp - 0x1c]
add ecx, 4
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 6
mov dword [ebp - 0x2b0], 0
jmp 0x43584c
mov edx, dword [ebp - 0x2b0]
add edx, 1
mov dword [ebp - 0x2b0], edx
cmp dword [ebp - 0x2b0], 1
jge 0x435893
mov eax, dword [ebp - 0x1c]
cdq
sub eax, edx
sar eax, 1
and eax, 0x80000001
jns 0x435869
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x435879
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x435891
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x435891
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x43583d
mov dword [ebp - 4], 0xfffffffe
call fcn.004358a1
jmp 0x4358b0
mov dword [ebp - 0x2b4], 1
mov dword [ebp - 0x2b8], 1
mov dword [ebp - 0x2bc], 2
mov dword [ebp - 0x2c0], 0
mov dword [ebp - 0x2c4], 0
jmp 0x4358f3
mov ecx, dword [ebp - 0x2c4]
add ecx, 1
mov dword [ebp - 0x2c4], ecx
cmp dword [ebp - 0x2c4], 2
jge 0x435934
mov edx, dword [ebp - 0x2b4]
add edx, dword [ebp - 0x2b8]
mov dword [ebp - 0x2bc], edx
mov eax, dword [ebp - 0x2b8]
mov dword [ebp - 0x2b4], eax
mov ecx, dword [ebp - 0x2bc]
mov dword [ebp - 0x2b8], ecx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x2bc]
mov dword [ebp - 0x1c], edx
jmp 0x4358e4
mov eax, dword [ebp - 0x1c]
add eax, 2
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c8], 1
mov dword [ebp - 0x2cc], 1
mov dword [ebp - 0x2d0], 2
mov dword [ebp - 0x2d4], 0
mov dword [ebp - 0x2d8], 0
jmp 0x435980
mov ecx, dword [ebp - 0x2d8]
add ecx, 1
mov dword [ebp - 0x2d8], ecx
cmp dword [ebp - 0x2d8], 4
jge 0x4359c1
mov edx, dword [ebp - 0x2c8]
add edx, dword [ebp - 0x2cc]
mov dword [ebp - 0x2d0], edx
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x2c8], eax
mov ecx, dword [ebp - 0x2d0]
mov dword [ebp - 0x2cc], ecx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x2d0]
mov dword [ebp - 0x1c], edx
jmp 0x435971
mov eax, dword [ebp - 0x1c]
add eax, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x2dc], 0
jmp 0x4359e5
mov ecx, dword [ebp - 0x2dc]
add ecx, 1
mov dword [ebp - 0x2dc], ecx
cmp dword [ebp - 0x2dc], 3
jge 0x4359fe
mov edx, dword [ebp - 0x2dc]
not edx
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x4359d6
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x435a12
mov eax, dword [ebp - 0x1c]
neg eax
imul eax, eax, 0xfffffffd
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x435a28
mov dword [ebp - 0x1c], 0xb
mov dword [ebp - 4], 7
mov dword [ebp - 0x2e0], 0
jmp 0x435a4a
mov edx, dword [ebp - 0x2e0]
add edx, 1
mov dword [ebp - 0x2e0], edx
cmp dword [ebp - 0x2e0], 1
jge 0x435a80
mov eax, dword [ebp - 0x2e0]
and eax, 0x80000001
jns 0x435a65
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x435a75
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x435a7e
mov edx, dword [ebp - 0x1c]
sub edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x435a3b
mov dword [ebp - 4], 0xfffffffe
call fcn.00435a8e
jmp 0x435aab
mov dword [ebp - 0x2e4], 0
jmp 0x435ac6
mov edx, dword [ebp - 0x2e4]
add edx, 1
mov dword [ebp - 0x2e4], edx
cmp dword [ebp - 0x2e4], 8
jge 0x435adf
mov eax, dword [ebp - 0x2e4]
not eax
xor eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x435ab7
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x435af3
mov ecx, dword [ebp - 0x1c]
neg ecx
imul ecx, ecx, 0xfffffffd
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x435b09
mov dword [ebp - 0x1c], 0xb
mov dword [ebp - 4], 8
mov dword [ebp - 0x2e8], 0
jmp 0x435b2b
mov edx, dword [ebp - 0x2e8]
add edx, 1
mov dword [ebp - 0x2e8], edx
cmp dword [ebp - 0x2e8], 1
jge 0x435b72
mov eax, dword [ebp - 0x1c]
cdq
sub eax, edx
sar eax, 1
and eax, 0x80000001
jns 0x435b48
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x435b58
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x435b70
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x435b70
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x435b1c
mov dword [ebp - 4], 0xfffffffe
call fcn.00435b80
jmp 0x435b8f
mov dword [ebp - 0x2ec], 1
mov dword [ebp - 0x2f0], 1
mov dword [ebp - 0x2f4], 2
mov dword [ebp - 0x2f8], 0
mov dword [ebp - 0x2fc], 0
jmp 0x435bd2
mov ecx, dword [ebp - 0x2fc]
add ecx, 1
mov dword [ebp - 0x2fc], ecx
cmp dword [ebp - 0x2fc], 1
jge 0x435c13
mov edx, dword [ebp - 0x2ec]
add edx, dword [ebp - 0x2f0]
mov dword [ebp - 0x2f4], edx
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0x2ec], eax
mov ecx, dword [ebp - 0x2f4]
mov dword [ebp - 0x2f0], ecx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x2f4]
mov dword [ebp - 0x1c], edx
jmp 0x435bc3
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 9
mov dword [ebp - 0x300], 0
jmp 0x435c3e
mov ecx, dword [ebp - 0x300]
add ecx, 1
mov dword [ebp - 0x300], ecx
cmp dword [ebp - 0x300], 2
jge 0x435c79
mov eax, dword [ebp - 0x300]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x435c6d
mov eax, dword [ebp - 0x300]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x435c74
and eax, 0xbc614e
jmp 0x435c77
mov dword [ebp - 0x1c], eax
jmp 0x435c2f
mov dword [ebp - 4], 0xfffffffe
call fcn.00435c87
jmp 0x435c8f
mov dword [ebp - 0x304], 0
jmp 0x435caa
mov edx, dword [ebp - 0x304]
add edx, 1
mov dword [ebp - 0x304], edx
cmp dword [ebp - 0x304], 4
jge 0x435cc3
mov eax, dword [ebp - 0x304]
not eax
xor eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x435c9b
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x435cd7
mov ecx, dword [ebp - 0x1c]
neg ecx
imul ecx, ecx, 0xfffffffd
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x435ced
mov dword [ebp - 0x1c], 0xb
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x308], 0
jmp 0x435d0f
mov edx, dword [ebp - 0x308]
add edx, 1
mov dword [ebp - 0x308], edx
cmp dword [ebp - 0x308], 0
jge 0x435d4a
mov eax, dword [ebp - 0x308]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x435d3e
mov eax, dword [ebp - 0x308]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x435d45
and eax, 0xbc614e
jmp 0x435d48
mov dword [ebp - 0x1c], eax
jmp 0x435d00
mov dword [ebp - 4], 0xfffffffe
call fcn.00435d58
jmp 0x435d60
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x30c], 0
jmp 0x435d82
mov edx, dword [ebp - 0x30c]
add edx, 1
mov dword [ebp - 0x30c], edx
cmp dword [ebp - 0x30c], 3
jge 0x435dc1
mov eax, dword [ebp - 0x30c]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x435db1
mov eax, dword [ebp - 0x30c]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x435dbc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1c], eax
jmp 0x435dbf
mov dword [ebp - 0x1c], eax
jmp 0x435d73
mov dword [ebp - 4], 0xfffffffe
call fcn.00435dcf
jmp 0x435dd7
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x310], 0
jmp 0x435df9
mov edx, dword [ebp - 0x310]
add edx, 1
mov dword [ebp - 0x310], edx
cmp dword [ebp - 0x310], 2
jge 0x435e34
mov eax, dword [ebp - 0x310]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x435e28
mov eax, dword [ebp - 0x310]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x435e2f
and eax, 0xbc614e
jmp 0x435e32
mov dword [ebp - 0x1c], eax
jmp 0x435dea
mov dword [ebp - 4], 0xfffffffe
call fcn.00435e42
jmp 0x435e4a
mov dword [ebp - 0x314], 1
mov dword [ebp - 0x318], 1
mov dword [ebp - 0x31c], 2
mov dword [ebp - 0x320], 0
mov dword [ebp - 0x324], 0
jmp 0x435e8d
mov edx, dword [ebp - 0x324]
add edx, 1
mov dword [ebp - 0x324], edx
cmp dword [ebp - 0x324], 3
jge 0x435ece
mov eax, dword [ebp - 0x314]
add eax, dword [ebp - 0x318]
mov dword [ebp - 0x31c], eax
mov ecx, dword [ebp - 0x318]
mov dword [ebp - 0x314], ecx
mov edx, dword [ebp - 0x31c]
mov dword [ebp - 0x318], edx
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x31c]
mov dword [ebp - 0x1c], eax
jmp 0x435e7e
mov ecx, dword [ebp - 0x1c]
add ecx, 3
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x328], 1
mov dword [ebp - 0x32c], 1
mov dword [ebp - 0x330], 2
mov dword [ebp - 0x334], 0
mov dword [ebp - 0x338], 0
jmp 0x435f1a
mov edx, dword [ebp - 0x338]
add edx, 1
mov dword [ebp - 0x338], edx
cmp dword [ebp - 0x338], 3
jge 0x435f5b
mov eax, dword [ebp - 0x328]
add eax, dword [ebp - 0x32c]
mov dword [ebp - 0x330], eax
mov ecx, dword [ebp - 0x32c]
mov dword [ebp - 0x328], ecx
mov edx, dword [ebp - 0x330]
mov dword [ebp - 0x32c], edx
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x330]
mov dword [ebp - 0x1c], eax
jmp 0x435f0b
mov ecx, dword [ebp - 0x1c]
add ecx, 3
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x33c], 0
jmp 0x435f86
mov edx, dword [ebp - 0x33c]
add edx, 1
mov dword [ebp - 0x33c], edx
cmp dword [ebp - 0x33c], 2
jge 0x435fc1
mov eax, dword [ebp - 0x33c]
cdq
mov ecx, 7
idiv ecx
cmp edx, 5
je 0x435fb5
mov eax, dword [ebp - 0x33c]
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 7
jne 0x435fbc
and eax, 0xbc614e
jmp 0x435fbf
mov dword [ebp - 0x1c], eax
jmp 0x435f77
mov dword [ebp - 4], 0xfffffffe
call fcn.00435fcf
jmp 0x435fd7
mov dword [ebp - 0x340], 0
jmp 0x435ff2
mov edx, dword [ebp - 0x340]
add edx, 1
mov dword [ebp - 0x340], edx
cmp dword [ebp - 0x340], 3
jge 0x43600b
mov eax, dword [ebp - 0x340]
not eax
xor eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x435fe3
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x43601f
mov ecx, dword [ebp - 0x1c]
neg ecx
imul ecx, ecx, 0xfffffffd
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x436035
mov dword [ebp - 0x1c], 0xb
mov dword [ebp - 0x344], 0
jmp 0x436050
mov edx, dword [ebp - 0x344]
add edx, 1
mov dword [ebp - 0x344], edx
cmp dword [ebp - 0x344], 0
jge 0x436069
mov eax, dword [ebp - 0x344]
not eax
xor eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x436041
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x43607d
mov ecx, dword [ebp - 0x1c]
neg ecx
imul ecx, ecx, 0xfffffffd
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x436093
mov dword [ebp - 0x1c], 0xb
mov dword [ebp - 0x348], 0
jmp 0x4360ae
mov edx, dword [ebp - 0x348]
add edx, 1
mov dword [ebp - 0x348], edx
cmp dword [ebp - 0x348], 1
jge 0x4360c7
mov eax, dword [ebp - 0x348]
not eax
xor eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x43609f
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4360db
mov ecx, dword [ebp - 0x1c]
neg ecx
imul ecx, ecx, 0xfffffffd
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4360f1
mov dword [ebp - 0x1c], 0xb
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x34c], 0
jmp 0x436113
mov edx, dword [ebp - 0x34c]
add edx, 1
mov dword [ebp - 0x34c], edx
cmp dword [ebp - 0x34c], 4
jge 0x43615a
mov eax, dword [ebp - 0x1c]
cdq
sub eax, edx
sar eax, 1
and eax, 0x80000001
jns 0x436130
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x436140
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x436158
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x436158
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x436104
mov dword [ebp - 4], 0xfffffffe
call fcn.00436168
jmp 0x436177
mov dword [ebp - 0x350], 0
jmp 0x436192
mov ecx, dword [ebp - 0x350]
add ecx, 1
mov dword [ebp - 0x350], ecx
cmp dword [ebp - 0x350], 2
jge 0x4361d3
cmp dword [ebp - 0x1c], 0
jge 0x4361a9
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4361bf
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x548]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x436183
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x54c], 0
jmp 0x4361f5
mov eax, dword [ebp - 0x54c]
add eax, 1
mov dword [ebp - 0x54c], eax
cmp dword [ebp - 0x54c], 3
jge 0x43623c
mov eax, dword [ebp - 0x1c]
cdq
sub eax, edx
sar eax, 1
and eax, 0x80000001
jns 0x436212
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x436222
mov ecx, dword [ebp - 0x1c]
and ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ecx
jmp 0x43623a
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x43623a
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x4361e6
mov dword [ebp - 4], 0xfffffffe
call fcn.0043624a
jmp 0x436259
mov dword [ebp - 0x550], 1
mov dword [ebp - 0x554], 1
mov dword [ebp - 0x558], 2
mov dword [ebp - 0x55c], 0
mov dword [ebp - 0x560], 0
jmp 0x43629c
mov ecx, dword [ebp - 0x560]
add ecx, 1
mov dword [ebp - 0x560], ecx
cmp dword [ebp - 0x560], 1
jge 0x4362dd
mov edx, dword [ebp - 0x550]
add edx, dword [ebp - 0x554]
mov dword [ebp - 0x558], edx
mov eax, dword [ebp - 0x554]
mov dword [ebp - 0x550], eax
mov ecx, dword [ebp - 0x558]
mov dword [ebp - 0x554], ecx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x558]
mov dword [ebp - 0x1c], edx
jmp 0x43628d
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x564], 0
jmp 0x436301
mov ecx, dword [ebp - 0x564]
add ecx, 1
mov dword [ebp - 0x564], ecx
cmp dword [ebp - 0x564], 3
jge 0x43631a
mov edx, dword [ebp - 0x564]
not edx
xor edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
jmp 0x4362f2
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x43632e
mov eax, dword [ebp - 0x1c]
neg eax
imul eax, eax, 0xfffffffd
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x436344
mov dword [ebp - 0x1c], 0xb
mov dword [ebp - 0x568], 1
mov dword [ebp - 0x56c], 1
mov dword [ebp - 0x570], 2
mov dword [ebp - 0x574], 0
mov dword [ebp - 0x578], 0
jmp 0x436387
mov edx, dword [ebp - 0x578]
add edx, 1
mov dword [ebp - 0x578], edx
cmp dword [ebp - 0x578], 2
jge 0x4363c8
mov eax, dword [ebp - 0x568]
add eax, dword [ebp - 0x56c]
mov dword [ebp - 0x570], eax
mov ecx, dword [ebp - 0x56c]
mov dword [ebp - 0x568], ecx
mov edx, dword [ebp - 0x570]
mov dword [ebp - 0x56c], edx
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x570]
mov dword [ebp - 0x1c], eax
jmp 0x436378
mov ecx, dword [ebp - 0x1c]
add ecx, 2
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x57c], 0
jmp 0x4363ec
mov edx, dword [ebp - 0x57c]
add edx, 1
mov dword [ebp - 0x57c], edx
cmp dword [ebp - 0x57c], 3
jge 0x436405
mov eax, dword [ebp - 0x57c]
not eax
xor eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x4363dd
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x436419
mov ecx, dword [ebp - 0x1c]
neg ecx
imul ecx, ecx, 0xfffffffd
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x43642f
mov dword [ebp - 0x1c], 0xb
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x580], 0
jmp 0x436451
cmp dword [ebp - 0x580], 4
jge 0x436487
mov eax, dword [ebp - 0x580]
and eax, 0x80000001
jns 0x43646c
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x43647c
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x436485
mov edx, dword [ebp - 0x1c]
sub edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x436442
mov dword [ebp - 4], 0xfffffffe
call fcn.00436495
jmp 0x4364b2
mov dword [ebp - 0x584], 0
jmp 0x4364cd
cmp dword [ebp - 0x584], 2
jge 0x4364e6